jschantli/MHW-Mod-Manager
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: add various system and theme icons, configuration files, and support assets

Browse Source
This commit is contained in:
jschantli committed 2026-10-03 08:14:42 -07:00
1 parent 848dac4264
commit 54baea79f4
15893 files changed
+781426 -2
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

AppImageBuilder (SFConflict Jacob Schantli 2026-09-22-18-48-54).yml
+43
View File
@@ -0,0 +1,43 @@
version: 1
AppDir:
path: ./AppDir
app_info:
id: ca.schantli.MHWildsModManager
name: MHWildsModManager
icon: ca.schantli.MHWildsModManager
version: 1.0.0
exec: usr/bin/python3
exec_args: -m mhwmm $@
apt:
arch: amd64
allow_unauthenticated: true
sources:
- sourceline: 'deb [arch=amd64] http://archive.ubuntu.com/ubuntu/ noble main restricted universe multiverse'
- sourceline: 'deb [arch=amd64] http://archive.ubuntu.com/ubuntu/ noble-updates main restricted universe multiverse'
include:
- python3
- python3-gi
- gir1.2-gtk-4.0
- gir1.2-adw-1
- libglib2.0-bin
- libgtk-4-1
- libadwaita-1-0
- adwaita-icon-theme
- python3-requests
files:
include: []
exclude:
- usr/share/man
- usr/share/doc/*/README.*
- usr/share/doc/*/changelog.*
- usr/share/doc/*/copyright
- usr/share/doc/*/TODO.*
runtime:
env:
PYTHONPATH: '${APPDIR}/usr/lib/python3.12/site-packages:${APPDIR}/usr/share/mhwmm'
AppImage:
update-information: None
sign-key: None
arch: x86_64
AppImageBuilder.yml
+17 -1
View File
@@ -2,6 +2,16 @@ version: 1
AppDir:
path: ./AppDir
after_bundle: |
echo "" >> $TARGET_APPDIR/usr/lib/x86_64-linux-gnu/gdk-pixbuf-2.0/2.10.0/loaders.cache
echo '"libpixbufloader-svg.so"' >> $TARGET_APPDIR/usr/lib/x86_64-linux-gnu/gdk-pixbuf-2.0/2.10.0/loaders.cache
echo '"svg" 6 "gdk-pixbuf" "Scalable Vector Graphics" "LGPL"' >> $TARGET_APPDIR/usr/lib/x86_64-linux-gnu/gdk-pixbuf-2.0/2.10.0/loaders.cache
echo '"image/svg+xml" "image/svg" "image/svg-xml" "image/vnd.adobe.svg+xml" "text/xml-svg" "image/svg+xml-compressed" ""' >> $TARGET_APPDIR/usr/lib/x86_64-linux-gnu/gdk-pixbuf-2.0/2.10.0/loaders.cache
echo '"svg" "svgz" "svg.gz" ""' >> $TARGET_APPDIR/usr/lib/x86_64-linux-gnu/gdk-pixbuf-2.0/2.10.0/loaders.cache
echo '" <svg" "* " 100' >> $TARGET_APPDIR/usr/lib/x86_64-linux-gnu/gdk-pixbuf-2.0/2.10.0/loaders.cache
echo '" <!DOCTYPE svg" "* " 100' >> $TARGET_APPDIR/usr/lib/x86_64-linux-gnu/gdk-pixbuf-2.0/2.10.0/loaders.cache
gtk-update-icon-cache -f -t $TARGET_APPDIR/usr/share/icons/hicolor || true
gtk-update-icon-cache -f -t $TARGET_APPDIR/usr/share/icons/Adwaita || true
app_info:
id: ca.schantli.MHWildsModManager
name: MHWildsModManager
@@ -25,6 +35,7 @@ AppDir:
- libadwaita-1-0
- adwaita-icon-theme
- python3-requests
- librsvg2-common
files:
include: []
exclude:
@@ -35,7 +46,12 @@ AppDir:
- usr/share/doc/*/TODO.*
runtime:
env:
PYTHONPATH: '${APPDIR}/usr/lib/python3.12/site-packages:${APPDIR}/usr/share/mhwmm'
PYTHONPATH: '${APPDIR}/usr/lib/python3.12/site-packages:${APPDIR}/usr/share'
XDG_DATA_DIRS: '${APPDIR}/usr/share:/usr/local/share:/usr/share'
GDK_PIXBUF_MODULE_FILE: '${APPDIR}/usr/lib/x86_64-linux-gnu/gdk-pixbuf-2.0/2.10.0/loaders.cache'
GDK_PIXBUF_MODULEDIR: '${APPDIR}/usr/lib/x86_64-linux-gnu/gdk-pixbuf-2.0/2.10.0/loaders'
GSETTINGS_SCHEMA_DIR: '${APPDIR}/usr/share/glib-2.0/schemas'
GTK_DATA_PREFIX: '${APPDIR}'
AppImage:
update-information: None
build_appimage.sh
+1 -1
View File
@@ -11,7 +11,7 @@ mkdir -p AppDir/usr/share/applications
mkdir -p AppDir/usr/share/icons/hicolor/256x256/apps
echo "Copying source files..."
cp -r src/mhwmm/* AppDir/usr/share/mhwmm/
cp -r src/mhwmm AppDir/usr/share/
cat << 'WRAPPER' > AppDir/usr/bin/mhwmm
#!/bin/bash
export PYTHONPATH="${APPDIR}/usr/share/mhwmm:${PYTHONPATH}"
data/ca.schantli.MHWildsModManager.png
BIN
View File
Binary file not shown.
Side by Side Swipe Overlay

Before

Width:  |  Height:  |  Size: 739 KiB

After

Width:  |  Height:  |  Size: 864 KiB

gtk_log.txt
View File
Whitespace-only changes.
icon_debug.log
+1
View File
@@ -0,0 +1 @@
bash: line 1: xvfb-run: command not found
squashfs-root/.DirIcon
Symlink
+1
View File
@@ -0,0 +1 @@
ca.schantli.MHWildsModManager.png
squashfs-root/.bundle.yml
+202
View File
@@ -0,0 +1,202 @@
apt:
sources:
- deb [arch=amd64] http://archive.ubuntu.com/ubuntu/ noble main restricted universe
multiverse
- deb [arch=amd64] http://archive.ubuntu.com/ubuntu/ noble-updates main restricted
universe multiverse
packages:
- python3-pkg-resources:all=68.1.2-2ubuntu1.2
- python3-gi:amd64=3.48.2-1
- libappstream5:amd64=1.0.2-1build6
- libavahi-common3:amd64=0.8-13ubuntu6.2
- libkmod2:amd64=31+20240202-2ubuntu7.2
- libtiff6:amd64=4.5.1+git230720-4ubuntu2.5
- libjpeg8:amd64=8c-2ubuntu11
- libldap2:amd64=2.6.10+dfsg-0ubuntu0.24.04.1
- libxmlb2:amd64=0.3.24-1~ubuntu0.24.04.1
- zlib1g:amd64=1:1.3.dfsg-3.1ubuntu2.2
- libxdamage1:amd64=1:1.1.6-1build1
- libidn2-0:amd64=2.3.7-2build1.1
- gtk-update-icon-cache:amd64=3.24.41-4ubuntu1.3
- gir1.2-harfbuzz-0.0:amd64=8.3.0-2build2
- libglib2.0-0t64:amd64=2.80.0-6ubuntu3.9
- libpam-modules:amd64=1.5.3-5ubuntu5.7
- libtasn1-6:amd64=4.19.0-3ubuntu0.24.04.2
- libfontconfig1:amd64=2.15.0-1.1ubuntu2
- libncursesw6:amd64=6.4+20240113-1ubuntu2.2
- libpam-modules-bin:amd64=1.5.3-5ubuntu5.7
- libsystemd0:amd64=255.4-1ubuntu8.17
- libgnutls30t64:amd64=3.8.3-1.1ubuntu3.6
- libgdk-pixbuf-2.0-0:amd64=2.42.10+dfsg-3ubuntu3.3
- libk5crypto3:amd64=1.20.1-6ubuntu2.10
- libcryptsetup12:amd64=2:2.7.0-1ubuntu4.2
- libbrotli1:amd64=1.1.0-2build2
- libcairo-gobject2:amd64=1.18.0-3build1
- libgirepository-1.0-1:amd64=1.80.1-1
- adwaita-icon-theme:all=46.0-1
- openssl:amd64=3.0.13-0ubuntu3.16
- dconf-gsettings-backend:amd64=0.40.0-4ubuntu0.1
- librsvg2-2:amd64=2.58.0+dfsg-1build1
- libacl1:amd64=2.3.2-1build1.1
- libxfixes3:amd64=1:6.0.0-2build1
- liblzma5:amd64=5.6.1+really5.4.5-1ubuntu0.3
- libharfbuzz0b:amd64=8.3.0-2build2
- gir1.2-gdkpixbuf-2.0:amd64=2.42.10+dfsg-3ubuntu3.3
- libdbus-1-3:amd64=1.14.10-4ubuntu4.1
- fontconfig-config:amd64=2.15.0-1.1ubuntu2
- netbase:all=6.4
- libcom-err2:amd64=1.47.0-2.4~exp1ubuntu4.1
- systemd:amd64=255.4-1ubuntu8.17
- libxml2:amd64=2.9.14+dfsg-1.3ubuntu3.9
- libc6:amd64=2.39-0ubuntu8.9
- fdisk:amd64=2.39.3-9ubuntu6.6
- libhogweed6t64:amd64=3.9.1-2.2build1.1
- python3:amd64=3.12.3-0ubuntu2.1
- libunistring5:amd64=1.1-2build1.1
- libgssapi-krb5-2:amd64=1.20.1-6ubuntu2.10
- dconf-service:amd64=0.40.0-4ubuntu0.1
- libcolord2:amd64=1.4.7-1build2
- libapparmor1:amd64=4.0.1really4.0.1-0ubuntu0.24.04.8
- dbus-system-bus-common:all=1.14.10-4ubuntu4.1
- libpangocairo-1.0-0:amd64=1.52.1+ds-1build1
- libudev1:amd64=255.4-1ubuntu8.17
- libepoxy0:amd64=1.5.10-1build1
- systemd-sysv:amd64=255.4-1ubuntu8.17
- fonts-dejavu-core:all=2.37-8
- liblerc4:amd64=4.0.0+ds-4ubuntu2
- libtinfo6:amd64=6.4+20240113-1ubuntu2.2
- gir1.2-freedesktop:amd64=1.80.1-1
- libsharpyuv0:amd64=1.3.2-0.4build3
- gir1.2-adw-1:amd64=1.5.0-1ubuntu2
- avahi-daemon:amd64=0.8-13ubuntu6.2
- libdb5.3t64:amd64=5.3.28+dfsg2-7
- libstemmer0d:amd64=2.2.0-4build1
- libcurl3t64-gnutls:amd64=8.5.0-2ubuntu10.15
- libsystemd-shared:amd64=255.4-1ubuntu8.17
- libpangoft2-1.0-0:amd64=1.52.1+ds-1build1
- libargon2-1:amd64=0~20190702+dfsg-4build1
- libicu74:amd64=74.2-1ubuntu3.1
- libproc2-0:amd64=2:4.0.4-4ubuntu3.3
- libdevmapper1.02.1:amd64=2:1.02.185-3ubuntu3.2
- libxcursor1:amd64=1:1.2.1-1build1
- libjson-c5:amd64=0.17-1build1
- gir1.2-glib-2.0:amd64=2.80.0-6ubuntu3.9
- gcc-14-base:amd64=14.2.0-4ubuntu2~24.04.1
- libp11-kit0:amd64=0.25.3-4ubuntu2.2
- libcups2t64:amd64=2.4.7-1.2ubuntu7.14
- libfdisk1:amd64=2.39.3-9ubuntu6.6
- dbus-daemon:amd64=1.14.10-4ubuntu4.1
- gir1.2-graphene-1.0:amd64=1.10.8-3build2
- libkeyutils1:amd64=1.6.3-3build1
- libgtk-4-1:amd64=4.14.5+ds-0ubuntu0.10
- fontconfig:amd64=2.15.0-1.1ubuntu2
- dbus-bin:amd64=1.14.10-4ubuntu4.1
- liblzo2-2:amd64=2.10-2build4
- libpsl5t64:amd64=0.21.2-1.1build1
- ca-certificates:all=20260601~24.04.1
- libthai-data:all=0.1.29-2build1
- libffi8:amd64=3.4.6-1build1
- libharfbuzz-gobject0:amd64=8.3.0-2build2
- libpython3-stdlib:amd64=3.12.3-0ubuntu2.1
- librtmp1:amd64=2.4+20151223.gitfa8646d.1-2build7
- liblcms2-2:amd64=2.14-2ubuntu0.1
- libzstd1:amd64=1.5.5+dfsg2-2build1.1
- libvulkan1:amd64=1.3.275.0-1build1
- libcap-ng0:amd64=0.8.4-2build2
- libfreetype6:amd64=2.13.2+dfsg-1ubuntu0.1
- gir1.2-gtk-4.0:amd64=4.14.5+ds-0ubuntu0.10
- libpam-systemd:amd64=255.4-1ubuntu8.17
- libaudit1:amd64=1:3.1.2-2.1ubuntu0.1
- fonts-dejavu-mono:all=2.37-8
- libdconf1:amd64=0.40.0-4ubuntu0.1
- libkrb5support0:amd64=1.20.1-6ubuntu2.10
- gir1.2-girepository-2.0:amd64=1.80.1-1
- libdatrie1:amd64=0.2.13-3build1
- libpam0g:amd64=1.5.3-5ubuntu5.7
- librsvg2-common:amd64=2.58.0+dfsg-1build1
- libgcrypt20:amd64=1.10.3-2ubuntu0.2
- tzdata:all=2026c-0ubuntu0.24.04.1
- libbz2-1.0:amd64=1.0.8-5.1ubuntu0.1
- libsqlite3-0:amd64=3.45.1-1ubuntu2.8
- dbus-user-session:amd64=1.14.10-4ubuntu4.1
- libgtk-4-common:all=4.14.5+ds-0ubuntu0.10
- libpython3.12-stdlib:amd64=3.12.3-1ubuntu0.17
- dbus:amd64=1.14.10-4ubuntu4.1
- libsasl2-modules-db:amd64=2.1.28+dfsg1-5ubuntu3.1
- mount:amd64=2.39.3-9ubuntu6.6
- libuuid1:amd64=2.39.3-9ubuntu6.6
- libelf1t64:amd64=0.190-1.1ubuntu0.1
- systemd-dev:all=255.4-1ubuntu8.17
- libpangoxft-1.0-0:amd64=1.52.1+ds-1build1
- libnettle8t64:amd64=3.9.1-2.2build1.1
- libgpg-error0:amd64=1.47-3build2.1
- libseccomp2:amd64=2.5.5-1ubuntu3.1
- libaudit-common:all=1:3.1.2-2.1ubuntu0.1
- libxrandr2:amd64=2:1.5.2-2build1
- libxext6:amd64=2:1.3.4-1build2
- libglib2.0-bin:amd64=2.80.0-6ubuntu3.9
- libpixman-1-0:amd64=0.42.2-1build1
- python3-chardet:all=5.2.0+dfsg-1
- libstdc++6:amd64=14.2.0-4ubuntu2~24.04.1
- python3.12-minimal:amd64=3.12.3-1ubuntu0.17
- python3-certifi:all=2023.11.17-1
- libpcre2-8-0:amd64=10.42-4ubuntu2.1
- libcap2-bin:amd64=1:2.66-5ubuntu2.4
- libdeflate0:amd64=1.19-1build1.1
- ubuntu-mono:all=24.04-0ubuntu1
- libdaemon0:amd64=0.14-7.1ubuntu4
- hicolor-icon-theme:all=0.17-2
- libthai0:amd64=0.1.29-2build1
- libreadline8t64:amd64=8.2-4build1
- util-linux:amd64=2.39.3-9ubuntu6.6
- libgdk-pixbuf2.0-common:all=2.42.10+dfsg-3ubuntu3.3
- libcap2:amd64=1:2.66-5ubuntu2.4
- libpython3.12-minimal:amd64=3.12.3-1ubuntu0.17
- libssh-4:amd64=0.10.6-2ubuntu0.5
- libcrypt1:amd64=1:4.4.36-4build1
- libselinux1:amd64=3.5-2ubuntu2.1
- libavahi-common-data:amd64=0.8-13ubuntu6.2
- python3-requests:all=2.31.0+dfsg-1ubuntu1.2
- libgcc-s1:amd64=14.2.0-4ubuntu2~24.04.1
- media-types:all=10.1.0
- libcairo-script-interpreter2:amd64=1.18.0-3build1
- libsmartcols1:amd64=2.39.3-9ubuntu6.6
- libglib2.0-data:all=2.80.0-6ubuntu3.9
- readline-common:all=8.2-4build1
- libgmp10:amd64=2:6.3.0+dfsg-2ubuntu6.1
- xkb-data:all=2.41-2ubuntu1.1
- libgraphite2-3:amd64=1.3.14-2ubuntu0.24.04.1
- libjbig0:amd64=2.1-6.1ubuntu2
- libxft2:amd64=2.3.6-1build1
- libkrb5-3:amd64=1.20.1-6ubuntu2.10
- libblkid1:amd64=2.39.3-9ubuntu6.6
- libexpat1:amd64=2.6.1-2ubuntu0.6
- gir1.2-pango-1.0:amd64=1.52.1+ds-1build1
- libavahi-client3:amd64=0.8-13ubuntu6.2
- libxi6:amd64=2:1.8.1-1build1
- libfribidi0:amd64=1.0.13-3build1
- python3-urllib3:all=2.0.7-1ubuntu0.7
- libpng16-16t64:amd64=1.6.43-5ubuntu0.6
- libadwaita-1-0:amd64=1.5.0-1ubuntu2
- libxrender1:amd64=1:0.9.10-1.1build1
- libxinerama1:amd64=2:1.1.4-3build1
- python3-idna:all=3.6-2ubuntu0.2
- libgraphene-1.0-0:amd64=1.10.8-3build2
- libnghttp2-14:amd64=1.59.0-1ubuntu0.4
- liblz4-1:amd64=1.9.4-1build1.1
- libyaml-0-2:amd64=0.2.5-1build1
- libpam-runtime:all=1.5.3-5ubuntu5.7
- libavahi-core7:amd64=0.8-13ubuntu6.2
- libssl3t64:amd64=3.0.13-0ubuntu3.16
- libmount1:amd64=2.39.3-9ubuntu6.6
- dbus-session-bus-common:all=1.14.10-4ubuntu4.1
- humanity-icon-theme:all=0.6.16
- libjpeg-turbo8:amd64=2.1.5-2ubuntu2
- libcairo2:amd64=1.18.0-3build1
- libsasl2-2:amd64=2.1.28+dfsg1-5ubuntu3.1
- procps:amd64=2:4.0.4-4ubuntu3.3
- libwebp7:amd64=1.3.2-0.4build3
- libpango-1.0-0:amd64=1.52.1+ds-1build1
- python3.12:amd64=3.12.3-1ubuntu0.17
- python3-minimal:amd64=3.12.3-0ubuntu2.1
- libxkbcommon0:amd64=1.6.0-1build1
squashfs-root/AppRun
Executable
BIN
View File
Binary file not shown.
squashfs-root/AppRun.env
+22
View File
@@ -0,0 +1,22 @@
APPDIR=$ORIGIN
APPIMAGE_UUID=WCGkbUc
APPDIR_EXEC_PATH=$APPDIR/usr/bin/python3
APPDIR_EXEC_ARGS=-m mhwmm $@
XDG_DATA_DIRS=$APPDIR/usr/local/share:$APPDIR/usr/share:$XDG_DATA_DIRS
XDG_CONFIG_DIRS=$APPDIR/etc/xdg:$XDG_CONFIG_DIRS
APPDIR_LIBRARY_PATH=$APPDIR/lib/x86_64-linux-gnu:$APPDIR/usr/lib/x86_64-linux-gnu:$APPDIR/usr/lib/x86_64-linux-gnu/cryptsetup:$APPDIR/usr/lib/x86_64-linux-gnu/gdk-pixbuf-2.0/2.10.0/loaders:$APPDIR/usr/lib/x86_64-linux-gnu/krb5/plugins/preauth:$APPDIR/usr/lib/x86_64-linux-gnu/sasl2:$APPDIR/usr/lib/x86_64-linux-gnu/security:$APPDIR/usr/lib/x86_64-linux-gnu/systemd:$APPDIR/lib/x86_64
PATH=$APPDIR/etc/init.d:$APPDIR/etc/security:$APPDIR/usr/bin:$APPDIR/usr/lib/dbus-1.0:$APPDIR/usr/lib/kernel/install.d:$APPDIR/usr/lib/python3.12:$APPDIR/usr/lib/python3.12/encodings:$APPDIR/usr/lib/python3.12/test:$APPDIR/usr/lib/python3.12/test/support:$APPDIR/usr/lib/ssl/misc:$APPDIR/usr/lib/systemd:$APPDIR/usr/lib/systemd/system-generators:$APPDIR/usr/lib/systemd/user-environment-generators:$APPDIR/usr/lib/systemd/user-generators:$APPDIR/usr/lib/x86_64-linux-gnu/gdk-pixbuf-2.0:$APPDIR/usr/lib/x86_64-linux-gnu/glib-2.0:$APPDIR/usr/libexec:$APPDIR/usr/sbin:$APPDIR/usr/share/bug:$APPDIR/usr/share/bug/systemd:$APPDIR/usr/share/doc/ca-certificates/examples/ca-certificates-local/debian:$APPDIR/usr/share/libgcrypt20:$APPDIR/usr/share/python3:$APPDIR/usr/share/python3/runtime.d:$PATH
GDK_PIXBUF_MODULEDIR=$APPDIR/usr/lib/x86_64-linux-gnu/gdk-pixbuf-2.0/2.10.0/loaders
GDK_PIXBUF_MODULE_FILE=$APPDIR/usr/lib/x86_64-linux-gnu/gdk-pixbuf-2.0/2.10.0/loaders.cache
GIO_MODULE_DIR=$APPDIR/usr/lib/x86_64-linux-gnu/gio/modules
GSETTINGS_SCHEMA_DIR=$APPDIR/usr/share/glib-2.0/schemas
GI_TYPELIB_PATH=$APPDIR/usr/lib/x86_64-linux-gnu/girepository-1.0
GTK_EXE_PREFIX=$APPDIR/usr
GTK_DATA_PREFIX=$APPDIR/usr
GTK_PATH=$APPDIR/usr/lib/x86_64-linux-gnu/gtk-4.0
APPDIR_LIBC_LIBRARY_PATH=$APPDIR/runtime/compat/usr/lib/x86_64-linux-gnu:$APPDIR/runtime/compat/usr/lib/x86_64-linux-gnu/gconv:$APPDIR/runtime/compat/usr/lib64
APPDIR_LIBC_VERSION=2.39
PYTHONHOME=$APPDIR/usr
PYTHONPATH=$APPDIR/usr/lib/python3.12/site-packages:$APPDIR/usr/share
APPDIR_PATH_MAPPINGS=/workspace/AppDir:$APPDIR;
APPDIR_LIBC_LINKER_PATH={'lib64/ld-linux-x86-64.so.2'}
squashfs-root/ca.schantli.MHWildsModManager.desktop
+13
View File
@@ -0,0 +1,13 @@
[Desktop Entry]
X-AppImage-Arch=x86_64
X-AppImage-Version=1.0.0
X-AppImage-Name=MHWildsModManager
Type=Application
Name=MH Wilds Mod Manager
Comment=Manage mods for Monster Hunter Wilds
Exec=mhwmm %u
Icon=applications-games
Terminal=false
Categories=Game;Utility;
MimeType=x-scheme-handler/nxm;
StartupNotify=true
squashfs-root/ca.schantli.MHWildsModManager.png
BIN
View File
Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 864 KiB

squashfs-root/etc/X11/Xsession.d/20dbus_xdg-runtime
+28
View File
@@ -0,0 +1,28 @@
# vim:set ft=sh sw=2 sts=2 et:
if [ -z "$DBUS_SESSION_BUS_ADDRESS" ] && [ -n "$XDG_RUNTIME_DIR" ] && \
[ "$XDG_RUNTIME_DIR" = "/run/user/`id -u`" ] && \
[ -S "$XDG_RUNTIME_DIR/bus" ]; then
# We are under systemd-logind or something remarkably similar, and
# a user-session socket has already been set up.
#
# Be nice to non-libdbus, non-sd-bus implementations by using
# that as the session bus address in the environment. The check for
# XDG_RUNTIME_DIR = "/run/user/`id -u`" is because we know that
# form of the address, from systemd-logind, doesn't need escaping,
# whereas arbitrary addresses might.
DBUS_SESSION_BUS_ADDRESS="unix:path=$XDG_RUNTIME_DIR/bus"
export DBUS_SESSION_BUS_ADDRESS
fi
if [ -x "/usr/bin/dbus-update-activation-environment" ]; then
# tell dbus-daemon --session (and systemd --user, if running)
# to put a minimal subset of the Xsession's environment in activated
# services' environments
dbus-update-activation-environment --verbose --systemd \
DBUS_SESSION_BUS_ADDRESS \
DISPLAY \
XAUTHORITY \
XDG_CURRENT_DESKTOP \
${NULL+}
fi
squashfs-root/etc/avahi/avahi-daemon.conf
+69
View File
@@ -0,0 +1,69 @@
# This file is part of avahi.
#
# avahi is free software; you can redistribute it and/or modify it
# under the terms of the GNU Lesser General Public License as
# published by the Free Software Foundation; either version 2 of the
# License, or (at your option) any later version.
#
# avahi is distributed in the hope that it will be useful, but WITHOUT
# ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
# or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public
# License for more details.
#
# You should have received a copy of the GNU Lesser General Public
# License along with avahi; if not, write to the Free Software
# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307
# USA.
# See avahi-daemon.conf(5) for more information on this configuration
# file!
[server]
#host-name=foo
#domain-name=local
#browse-domains=0pointer.de, zeroconf.org
use-ipv4=yes
use-ipv6=yes
#allow-interfaces=eth0
#deny-interfaces=eth1
#check-response-ttl=no
#use-iff-running=no
#enable-dbus=yes
#disallow-other-stacks=no
#allow-point-to-point=no
#cache-entries-max=4096
#clients-max=4096
#objects-per-client-max=1024
#entries-per-entry-group-max=32
ratelimit-interval-usec=1000000
ratelimit-burst=1000
[wide-area]
enable-wide-area=yes
[publish]
#disable-publishing=no
#disable-user-service-publishing=no
#add-service-cookie=no
#publish-addresses=yes
publish-hinfo=no
publish-workstation=no
#publish-domain=yes
#publish-dns-servers=192.168.50.1, 192.168.50.2
#publish-resolv-conf-dns-servers=yes
#publish-aaaa-on-ipv4=yes
#publish-a-on-ipv6=no
[reflector]
#enable-reflector=no
#reflect-ipv=no
#reflect-filters=_airplay._tcp.local,_raop._tcp.local
[rlimits]
#rlimit-as=
#rlimit-core=0
#rlimit-data=8388608
#rlimit-fsize=0
#rlimit-nofile=768
#rlimit-stack=8388608
#rlimit-nproc=3
squashfs-root/etc/avahi/hosts
+27
View File
@@ -0,0 +1,27 @@
# This file is part of avahi.
#
# avahi is free software; you can redistribute it and/or modify it
# under the terms of the GNU Lesser General Public License as
# published by the Free Software Foundation; either version 2 of the
# License, or (at your option) any later version.
#
# avahi is distributed in the hope that it will be useful, but WITHOUT
# ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
# or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public
# License for more details.
#
# You should have received a copy of the GNU Lesser General Public
# License along with avahi; if not, write to the Free Software
# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307
# USA.
# This file contains static ip address <-> host name mappings. These
# can be useful to publish services on behalf of a non-avahi enabled
# device. Please bear in mind that host names are expected to be
# fully qualified domain names, i.e. ending in .local!
# See avahi.hosts(5) for more information on this configuration file!
# Examples:
# 192.168.0.1 router.local
# 2001::81:1 test.local
squashfs-root/etc/default/dbus
+7
View File
@@ -0,0 +1,7 @@
# This is a configuration file for /etc/init.d/dbus; it allows you to
# perform common modifications to the behavior of the dbus daemon
# startup without editing the init script (and thus getting prompted
# by dpkg on upgrades). We all love dpkg prompts.
# Parameters to pass to dbus.
PARAMS=""
squashfs-root/etc/ethertypes
+46
View File
@@ -0,0 +1,46 @@
# Ethernet frame types
#
# The EtherType is a two-octet field of Ethernet frames used to indicate
# which protocol is contained in their payload.
#
# More entries, mostly historical, can be found on:
# https://www.iana.org/assignments/ieee-802-numbers/
# http://standards-oui.ieee.org/ethertype/eth.txt
#
# <name> <hexnumber> <alias1>...<alias35> # Comment
#
IPv4 0800 ip ip4 # IP (IPv4)
X25 0805
ARP 0806 ether-arp # Address Resolution Protocol
FR_ARP 0808 # Frame Relay ARP [RFC1701]
BPQ 08FF # G8BPQ AX.25 over Ethernet
TRILL 22F3 # TRILL [RFC6325]
L2-IS-IS 22F4 # TRILL IS-IS [RFC6325]
TEB 6558 # Transparent Ethernet Bridging [RFC1701]
RAW_FR 6559 # Raw Frame Relay [RFC1701]
RARP 8035 # Reverse ARP [RFC903]
ATALK 809B # Appletalk
AARP 80F3 # Appletalk Address Resolution Protocol
802_1Q 8100 8021q 1q 802.1q dot1q # VLAN tagged frame [802.1q]
IPX 8137 # Novell IPX
NetBEUI 8191 # NetBEUI
IPv6 86DD ip6 # IP version 6
PPP 880B # Point-to-Point Protocol
MPLS 8847 # MPLS [RFC5332]
MPLS_MULTI 8848 # MPLS with upstream-assigned label [RFC5332]
ATMMPOA 884C # MultiProtocol over ATM
PPP_DISC 8863 # PPP over Ethernet discovery stage
PPP_SES 8864 # PPP over Ethernet session stage
ATMFATE 8884 # Frame-based ATM Transport over Ethernet
EAPOL 888E # EAP over LAN [802.1x]
S-TAG 88A8 # QinQ Service VLAN tag identifier [802.1q]
EAP_PREAUTH 88C7 # EAPOL Pre-Authentication [802.11i]
LLDP 88CC # Link Layer Discovery Protocol [802.1ab]
MACSEC 88E5 # Media Access Control Security [802.1ae]
PBB 88E7 macinmac # Provider Backbone Bridging [802.1ah]
MVRP 88F5 # Multiple VLAN Registration Protocol [802.1q]
PTP 88F7 # Precision Time Protocol
FCOE 8906 # Fibre Channel over Ethernet
FIP 8914 # FCoE Initialization Protocol
ROCE 8915 # RDMA over Converged Ethernet
LoWPAN A0ED # LoWPAN encapsulation
squashfs-root/etc/fonts/conf.avail/20-unhint-small-dejavu-lgc-sans-mono.conf
+26
View File
@@ -0,0 +1,26 @@
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE fontconfig SYSTEM "../fonts.dtd">
<fontconfig>
<!-- /etc/fonts/conf.d/20-unhint-small-dejavu-lgc-sans-mono.conf
Disable hinting manually at smaller sizes (< 8ppem)
This is a copy of the Bistream Vera fonts fonts rule, as DejaVu is
derived from Vera.
The Bistream Vera fonts have GASP entries suggesting that hinting be
disabled below 8 ppem, but FreeType ignores those, preferring to use
the data found in the instructed hints. The initial Vera release
didn't include the right instructions in the 'prep' table.
-->
<match target="font">
<test name="family">
<string>DejaVu LGC Sans Mono</string>
</test>
<test compare="less" name="pixelsize">
<double>7.5</double>
</test>
<edit name="hinting">
<bool>false</bool>
</edit>
</match>
</fontconfig>
squashfs-root/etc/fonts/conf.avail/20-unhint-small-dejavu-lgc-sans.conf
+26
View File
@@ -0,0 +1,26 @@
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE fontconfig SYSTEM "../fonts.dtd">
<fontconfig>
<!-- /etc/fonts/conf.d/20-unhint-small-dejavu-lgc-sans.conf
Disable hinting manually at smaller sizes (< 8ppem)
This is a copy of the Bistream Vera fonts fonts rule, as DejaVu is
derived from Vera.
The Bistream Vera fonts have GASP entries suggesting that hinting be
disabled below 8 ppem, but FreeType ignores those, preferring to use
the data found in the instructed hints. The initial Vera release
didn't include the right instructions in the 'prep' table.
-->
<match target="font">
<test name="family">
<string>DejaVu LGC Sans</string>
</test>
<test compare="less" name="pixelsize">
<double>7.5</double>
</test>
<edit name="hinting">
<bool>false</bool>
</edit>
</match>
</fontconfig>
squashfs-root/etc/fonts/conf.avail/20-unhint-small-dejavu-lgc-serif.conf
+26
View File
@@ -0,0 +1,26 @@
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE fontconfig SYSTEM "../fonts.dtd">
<fontconfig>
<!-- /etc/fonts/conf.d/20-unhint-small-dejavu-lgc-serif.conf
Disable hinting manually at smaller sizes (< 8ppem)
This is a copy of the Bistream Vera fonts fonts rule, as DejaVu is
derived from Vera.
The Bistream Vera fonts have GASP entries suggesting that hinting be
disabled below 8 ppem, but FreeType ignores those, preferring to use
the data found in the instructed hints. The initial Vera release
didn't include the right instructions in the 'prep' table.
-->
<match target="font">
<test name="family">
<string>DejaVu LGC Serif</string>
</test>
<test compare="less" name="pixelsize">
<double>7.5</double>
</test>
<edit name="hinting">
<bool>false</bool>
</edit>
</match>
</fontconfig>
squashfs-root/etc/fonts/conf.avail/20-unhint-small-dejavu-sans-mono.conf
+26
View File
@@ -0,0 +1,26 @@
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE fontconfig SYSTEM "../fonts.dtd">
<fontconfig>
<!-- /etc/fonts/conf.d/20-unhint-small-dejavu-sans-mono.conf
Disable hinting manually at smaller sizes (< 8ppem)
This is a copy of the Bistream Vera fonts fonts rule, as DejaVu is
derived from Vera.
The Bistream Vera fonts have GASP entries suggesting that hinting be
disabled below 8 ppem, but FreeType ignores those, preferring to use
the data found in the instructed hints. The initial Vera release
didn't include the right instructions in the 'prep' table.
-->
<match target="font">
<test name="family">
<string>DejaVu Sans Mono</string>
</test>
<test compare="less" name="pixelsize">
<double>7.5</double>
</test>
<edit name="hinting">
<bool>false</bool>
</edit>
</match>
</fontconfig>
squashfs-root/etc/fonts/conf.avail/20-unhint-small-dejavu-sans.conf
+26
View File
@@ -0,0 +1,26 @@
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE fontconfig SYSTEM "../fonts.dtd">
<fontconfig>
<!-- /etc/fonts/conf.d/20-unhint-small-dejavu-sans.conf
Disable hinting manually at smaller sizes (< 8ppem)
This is a copy of the Bistream Vera fonts fonts rule, as DejaVu is
derived from Vera.
The Bistream Vera fonts have GASP entries suggesting that hinting be
disabled below 8 ppem, but FreeType ignores those, preferring to use
the data found in the instructed hints. The initial Vera release
didn't include the right instructions in the 'prep' table.
-->
<match target="font">
<test name="family">
<string>DejaVu Sans</string>
</test>
<test compare="less" name="pixelsize">
<double>7.5</double>
</test>
<edit name="hinting">
<bool>false</bool>
</edit>
</match>
</fontconfig>
squashfs-root/etc/fonts/conf.avail/20-unhint-small-dejavu-serif.conf
+26
View File
@@ -0,0 +1,26 @@
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE fontconfig SYSTEM "../fonts.dtd">
<fontconfig>
<!-- /etc/fonts/conf.d/20-unhint-small-dejavu-serif.conf
Disable hinting manually at smaller sizes (< 8ppem)
This is a copy of the Bistream Vera fonts fonts rule, as DejaVu is
derived from Vera.
The Bistream Vera fonts have GASP entries suggesting that hinting be
disabled below 8 ppem, but FreeType ignores those, preferring to use
the data found in the instructed hints. The initial Vera release
didn't include the right instructions in the 'prep' table.
-->
<match target="font">
<test name="family">
<string>DejaVu Serif</string>
</test>
<test compare="less" name="pixelsize">
<double>7.5</double>
</test>
<edit name="hinting">
<bool>false</bool>
</edit>
</match>
</fontconfig>
squashfs-root/etc/fonts/conf.avail/57-dejavu-sans-mono.conf
+48
View File
@@ -0,0 +1,48 @@
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE fontconfig SYSTEM "../fonts.dtd">
<!-- /etc/fonts/conf.d/57-dejavu-sans-mono.conf
Define aliasing and other fontconfig settings for
DejaVu Sans Mono.
© 2006-2008 Nicolas Mailhot <nicolas.mailhot at laposte.net>
-->
<fontconfig>
<!-- Font substitution rules -->
<alias binding="same">
<family>Bepa Mono</family>
<accept>
<family>DejaVu Sans Mono</family>
</accept>
</alias>
<alias binding="same">
<family>Bitstream Prima Sans Mono</family>
<accept>
<family>DejaVu Sans Mono</family>
</accept>
</alias>
<alias binding="same">
<family>Bitstream Vera Sans Mono</family>
<accept>
<family>DejaVu Sans Mono</family>
</accept>
</alias>
<alias binding="same">
<family>DejaVu LGC Sans Mono</family>
<accept>
<family>DejaVu Sans Mono</family>
</accept>
</alias>
<alias binding="same">
<family>Olwen Sans Mono</family>
<accept>
<family>DejaVu Sans Mono</family>
</accept>
</alias>
<alias binding="same">
<family>SUSE Sans Mono</family>
<accept>
<family>DejaVu Sans Mono</family>
</accept>
</alias>
</fontconfig>
squashfs-root/etc/fonts/conf.avail/57-dejavu-sans.conf
+73
View File
@@ -0,0 +1,73 @@
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE fontconfig SYSTEM "../fonts.dtd">
<!-- /etc/fonts/conf.d/57-dejavu-sans.conf
Define aliasing and other fontconfig settings for
DejaVu Sans.
© 2006-2008 Nicolas Mailhot <nicolas.mailhot at laposte.net>
-->
<fontconfig>
<!-- Font substitution rules -->
<alias binding="same">
<family>Arev Sans</family>
<accept>
<family>DejaVu Sans</family>
</accept>
</alias>
<alias binding="same">
<family>Bepa</family>
<accept>
<family>DejaVu Sans</family>
</accept>
</alias>
<alias binding="same">
<family>Bitstream Prima Sans</family>
<accept>
<family>DejaVu Sans</family>
</accept>
</alias>
<alias binding="same">
<family>Bitstream Vera Sans</family>
<accept>
<family>DejaVu Sans</family>
</accept>
</alias>
<alias binding="same">
<family>DejaVu LGC Sans</family>
<accept>
<family>DejaVu Sans</family>
</accept>
</alias>
<alias binding="same">
<family>Hunky Sans</family>
<accept>
<family>DejaVu Sans</family>
</accept>
</alias>
<alias binding="same">
<family>Olwen Sans</family>
<accept>
<family>DejaVu Sans</family>
</accept>
</alias>
<alias binding="same">
<family>SUSE Sans</family>
<accept>
<family>DejaVu Sans</family>
</accept>
</alias>
<alias binding="same">
<family>Verajja</family>
<accept>
<family>DejaVu Sans</family>
</accept>
</alias>
<!-- In case VerajjaPDA stops declaring itself as Verajja -->
<alias binding="same">
<family>VerajjaPDA</family>
<accept>
<family>DejaVu Sans</family>
</accept>
</alias>
</fontconfig>
squashfs-root/etc/fonts/conf.avail/57-dejavu-serif.conf
+55
View File
@@ -0,0 +1,55 @@
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE fontconfig SYSTEM "../fonts.dtd">
<!-- /etc/fonts/conf.d/57-dejavu-serif.conf
Define aliasing and other fontconfig settings for
DejaVu Serif.
© 2006-2008 Nicolas Mailhot <nicolas.mailhot at laposte.net>
-->
<fontconfig>
<!-- Font substitution rules -->
<alias binding="same">
<family>Bitstream Prima Serif</family>
<accept>
<family>DejaVu Serif</family>
</accept>
</alias>
<alias binding="same">
<family>Bitstream Vera Serif</family>
<accept>
<family>DejaVu Serif</family>
</accept>
</alias>
<alias binding="same">
<family>DejaVu LGC Serif</family>
<accept>
<family>DejaVu Serif</family>
</accept>
</alias>
<alias binding="same">
<family>Hunky Serif</family>
<accept>
<family>DejaVu Serif</family>
</accept>
</alias>
<alias binding="same">
<family>Olwen Serif</family>
<accept>
<family>DejaVu Serif</family>
</accept>
</alias>
<alias binding="same">
<family>SUSE Serif</family>
<accept>
<family>DejaVu Serif</family>
</accept>
</alias>
<!-- In case Verajja Serif stops declaring itself as DejaVu Serif -->
<alias binding="same">
<family>Verajja Serif</family>
<accept>
<family>DejaVu Serif</family>
</accept>
</alias>
</fontconfig>
squashfs-root/etc/fonts/conf.avail/58-dejavu-lgc-sans-mono.conf
+62
View File
@@ -0,0 +1,62 @@
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE fontconfig SYSTEM "../fonts.dtd">
<!-- /etc/fonts/conf.d/58-dejavu-lgc-sans-mono.conf
Define aliasing and other fontconfig settings for
DejaVu LGC Sans Mono.
© 2006-2008 Nicolas Mailhot <nicolas.mailhot at laposte.net>
-->
<fontconfig>
<!-- Font substitution rules -->
<alias binding="same">
<family>Bepa Mono</family>
<accept>
<family>DejaVu LGC Sans Mono</family>
</accept>
</alias>
<alias binding="same">
<family>Bitstream Prima Sans Mono</family>
<accept>
<family>DejaVu LGC Sans Mono</family>
</accept>
</alias>
<alias binding="same">
<family>Bitstream Vera Sans Mono</family>
<accept>
<family>DejaVu LGC Sans Mono</family>
</accept>
</alias>
<alias binding="same">
<family>DejaVu Sans Mono</family>
<accept>
<family>DejaVu LGC Sans Mono</family>
</accept>
</alias>
<alias binding="same">
<family>Olwen Sans Mono</family>
<accept>
<family>DejaVu LGC Sans Mono</family>
</accept>
</alias>
<alias binding="same">
<family>SUSE Sans Mono</family>
<accept>
<family>DejaVu LGC Sans Mono</family>
</accept>
</alias>
<!-- Generic name assignment -->
<alias>
<family>DejaVu LGC Sans Mono</family>
<default>
<family>monospace</family>
</default>
</alias>
<!-- Generic name aliasing -->
<alias>
<family>monospace</family>
<prefer>
<family>DejaVu LGC Sans Mono</family>
</prefer>
</alias>
</fontconfig>
squashfs-root/etc/fonts/conf.avail/58-dejavu-lgc-sans.conf
+87
View File
@@ -0,0 +1,87 @@
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE fontconfig SYSTEM "../fonts.dtd">
<!-- /etc/fonts/conf.d/58-dejavu-lgc-sans.conf
Define aliasing and other fontconfig settings for
DejaVu LGC Sans.
© 2006-2008 Nicolas Mailhot <nicolas.mailhot at laposte.net>
-->
<fontconfig>
<!-- Font substitution rules -->
<alias binding="same">
<family>Arev Sans</family>
<accept>
<family>DejaVu LGC Sans</family>
</accept>
</alias>
<alias binding="same">
<family>Bepa</family>
<accept>
<family>DejaVu LGC Sans</family>
</accept>
</alias>
<alias binding="same">
<family>Bitstream Prima Sans</family>
<accept>
<family>DejaVu LGC Sans</family>
</accept>
</alias>
<alias binding="same">
<family>Bitstream Vera Sans</family>
<accept>
<family>DejaVu LGC Sans</family>
</accept>
</alias>
<alias binding="same">
<family>DejaVu Sans</family>
<accept>
<family>DejaVu LGC Sans</family>
</accept>
</alias>
<alias binding="same">
<family>Hunky Sans</family>
<accept>
<family>DejaVu LGC Sans</family>
</accept>
</alias>
<alias binding="same">
<family>Olwen Sans</family>
<accept>
<family>DejaVu LGC Sans</family>
</accept>
</alias>
<alias binding="same">
<family>SUSE Sans</family>
<accept>
<family>DejaVu LGC Sans</family>
</accept>
</alias>
<alias binding="same">
<family>Verajja</family>
<accept>
<family>DejaVu LGC Sans</family>
</accept>
</alias>
<!-- In case VerajjaPDA stops declaring itself as Verajja -->
<alias binding="same">
<family>VerajjaPDA</family>
<accept>
<family>DejaVu LGC Sans</family>
</accept>
</alias>
<!-- Generic name assignment -->
<alias>
<family>DejaVu LGC Sans</family>
<default>
<family>sans-serif</family>
</default>
</alias>
<!-- Generic name aliasing -->
<alias>
<family>sans-serif</family>
<prefer>
<family>DejaVu LGC Sans</family>
</prefer>
</alias>
</fontconfig>
squashfs-root/etc/fonts/conf.avail/58-dejavu-lgc-serif.conf
+69
View File
@@ -0,0 +1,69 @@
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE fontconfig SYSTEM "../fonts.dtd">
<!-- /etc/fonts/conf.d/58-dejavu-lgc-serif.conf
Define aliasing and other fontconfig settings for
DejaVu LGC Serif.
© 2006-2008 Nicolas Mailhot <nicolas.mailhot at laposte.net>
-->
<fontconfig>
<!-- Font substitution rules -->
<alias binding="same">
<family>Bitstream Prima Serif</family>
<accept>
<family>DejaVu LGC Serif</family>
</accept>
</alias>
<alias binding="same">
<family>Bitstream Vera Serif</family>
<accept>
<family>DejaVu LGC Serif</family>
</accept>
</alias>
<alias binding="same">
<family>DejaVu Serif</family>
<accept>
<family>DejaVu LGC Serif</family>
</accept>
</alias>
<alias binding="same">
<family>Hunky Serif</family>
<accept>
<family>DejaVu LGC Serif</family>
</accept>
</alias>
<alias binding="same">
<family>Olwen Serif</family>
<accept>
<family>DejaVu LGC Serif</family>
</accept>
</alias>
<alias binding="same">
<family>SUSE Serif</family>
<accept>
<family>DejaVu LGC Serif</family>
</accept>
</alias>
<!-- In case Verajja Serif stops declaring itself as DejaVu Serif -->
<alias binding="same">
<family>Verajja Serif</family>
<accept>
<family>DejaVu LGC Serif</family>
</accept>
</alias>
<!-- Generic name assignment -->
<alias>
<family>DejaVu LGC Serif</family>
<default>
<family>serif</family>
</default>
</alias>
<!-- Generic name aliasing -->
<alias>
<family>serif</family>
<prefer>
<family>DejaVu LGC Serif</family>
</prefer>
</alias>
</fontconfig>
squashfs-root/etc/fonts/conf.d/10-hinting-slight.conf
Symlink
+1
View File
@@ -0,0 +1 @@
../../../usr/share/fontconfig/conf.avail/10-hinting-slight.conf
squashfs-root/etc/fonts/conf.d/10-scale-bitmap-fonts.conf
Symlink
+1
View File
@@ -0,0 +1 @@
../../../usr/share/fontconfig/conf.avail/10-scale-bitmap-fonts.conf
squashfs-root/etc/fonts/conf.d/10-sub-pixel-rgb.conf
Symlink
+1
View File
@@ -0,0 +1 @@
../../../usr/share/fontconfig/conf.avail/10-sub-pixel-rgb.conf
squashfs-root/etc/fonts/conf.d/10-yes-antialias.conf
Symlink
+1
View File
@@ -0,0 +1 @@
../../../usr/share/fontconfig/conf.avail/10-yes-antialias.conf
squashfs-root/etc/fonts/conf.d/11-lcdfilter-default.conf
Symlink
+1
View File
@@ -0,0 +1 @@
../../../usr/share/fontconfig/conf.avail/11-lcdfilter-default.conf
squashfs-root/etc/fonts/conf.d/20-unhint-small-dejavu-lgc-sans-mono.conf
Symlink
+1
View File
@@ -0,0 +1 @@
../conf.avail/20-unhint-small-dejavu-lgc-sans-mono.conf
squashfs-root/etc/fonts/conf.d/20-unhint-small-dejavu-lgc-sans.conf
Symlink
+1
View File
@@ -0,0 +1 @@
../conf.avail/20-unhint-small-dejavu-lgc-sans.conf
squashfs-root/etc/fonts/conf.d/20-unhint-small-dejavu-lgc-serif.conf
Symlink
+1
View File
@@ -0,0 +1 @@
../conf.avail/20-unhint-small-dejavu-lgc-serif.conf
squashfs-root/etc/fonts/conf.d/20-unhint-small-dejavu-sans-mono.conf
Symlink
+1
View File
@@ -0,0 +1 @@
../conf.avail/20-unhint-small-dejavu-sans-mono.conf
squashfs-root/etc/fonts/conf.d/20-unhint-small-dejavu-sans.conf
Symlink
+1
View File
@@ -0,0 +1 @@
../conf.avail/20-unhint-small-dejavu-sans.conf
squashfs-root/etc/fonts/conf.d/20-unhint-small-dejavu-serif.conf
Symlink
+1
View File
@@ -0,0 +1 @@
../conf.avail/20-unhint-small-dejavu-serif.conf
squashfs-root/etc/fonts/conf.d/20-unhint-small-vera.conf
Symlink
+1
View File
@@ -0,0 +1 @@
../../../usr/share/fontconfig/conf.avail/20-unhint-small-vera.conf
squashfs-root/etc/fonts/conf.d/30-metric-aliases.conf
Symlink
+1
View File
@@ -0,0 +1 @@
../../../usr/share/fontconfig/conf.avail/30-metric-aliases.conf
squashfs-root/etc/fonts/conf.d/40-nonlatin.conf
Symlink
+1
View File
@@ -0,0 +1 @@
../../../usr/share/fontconfig/conf.avail/40-nonlatin.conf
squashfs-root/etc/fonts/conf.d/45-generic.conf
Symlink
+1
View File
@@ -0,0 +1 @@
../../../usr/share/fontconfig/conf.avail/45-generic.conf
squashfs-root/etc/fonts/conf.d/45-latin.conf
Symlink
+1
View File
@@ -0,0 +1 @@
../../../usr/share/fontconfig/conf.avail/45-latin.conf
squashfs-root/etc/fonts/conf.d/48-spacing.conf
Symlink
+1
View File
@@ -0,0 +1 @@
../../../usr/share/fontconfig/conf.avail/48-spacing.conf
squashfs-root/etc/fonts/conf.d/49-sansserif.conf
Symlink
+1
View File
@@ -0,0 +1 @@
../../../usr/share/fontconfig/conf.avail/49-sansserif.conf
squashfs-root/etc/fonts/conf.d/50-user.conf
Symlink
+1
View File
@@ -0,0 +1 @@
../../../usr/share/fontconfig/conf.avail/50-user.conf
squashfs-root/etc/fonts/conf.d/51-local.conf
Symlink
+1
View File
@@ -0,0 +1 @@
../../../usr/share/fontconfig/conf.avail/51-local.conf
squashfs-root/etc/fonts/conf.d/57-dejavu-sans-mono.conf
Symlink
+1
View File
@@ -0,0 +1 @@
../conf.avail/57-dejavu-sans-mono.conf
squashfs-root/etc/fonts/conf.d/57-dejavu-sans.conf
Symlink
+1
View File
@@ -0,0 +1 @@
../conf.avail/57-dejavu-sans.conf
squashfs-root/etc/fonts/conf.d/57-dejavu-serif.conf
Symlink
+1
View File
@@ -0,0 +1 @@
../conf.avail/57-dejavu-serif.conf
squashfs-root/etc/fonts/conf.d/58-dejavu-lgc-sans-mono.conf
Symlink
+1
View File
@@ -0,0 +1 @@
../conf.avail/58-dejavu-lgc-sans-mono.conf
squashfs-root/etc/fonts/conf.d/58-dejavu-lgc-sans.conf
Symlink
+1
View File
@@ -0,0 +1 @@
../conf.avail/58-dejavu-lgc-sans.conf
squashfs-root/etc/fonts/conf.d/58-dejavu-lgc-serif.conf
Symlink
+1
View File
@@ -0,0 +1 @@
../conf.avail/58-dejavu-lgc-serif.conf
squashfs-root/etc/fonts/conf.d/60-generic.conf
Symlink
+1
View File
@@ -0,0 +1 @@
../../../usr/share/fontconfig/conf.avail/60-generic.conf
squashfs-root/etc/fonts/conf.d/60-latin.conf
Symlink
+1
View File
@@ -0,0 +1 @@
../../../usr/share/fontconfig/conf.avail/60-latin.conf
squashfs-root/etc/fonts/conf.d/65-fonts-persian.conf
Symlink
+1
View File
@@ -0,0 +1 @@
../../../usr/share/fontconfig/conf.avail/65-fonts-persian.conf
squashfs-root/etc/fonts/conf.d/65-nonlatin.conf
Symlink
+1
View File
@@ -0,0 +1 @@
../../../usr/share/fontconfig/conf.avail/65-nonlatin.conf
squashfs-root/etc/fonts/conf.d/69-unifont.conf
Symlink
+1
View File
@@ -0,0 +1 @@
../../../usr/share/fontconfig/conf.avail/69-unifont.conf
squashfs-root/etc/fonts/conf.d/70-no-bitmaps-except-emoji.conf
Symlink
+1
View File
@@ -0,0 +1 @@
../../../usr/share/fontconfig/conf.avail/70-no-bitmaps-except-emoji.conf
squashfs-root/etc/fonts/conf.d/80-delicious.conf
Symlink
+1
View File
@@ -0,0 +1 @@
../../../usr/share/fontconfig/conf.avail/80-delicious.conf
squashfs-root/etc/fonts/conf.d/90-synthetic.conf
Symlink
+1
View File
@@ -0,0 +1 @@
../../../usr/share/fontconfig/conf.avail/90-synthetic.conf
squashfs-root/etc/fonts/conf.d/README
+23
View File
@@ -0,0 +1,23 @@
conf.d/README
Each file in this directory is a fontconfig configuration file. Fontconfig
scans this directory, loading all files of the form [0-9][0-9]*.conf.
These files are normally installed in /usr/share/fontconfig/conf.avail
and then symlinked here, allowing them to be easily installed and then
enabled/disabled by adjusting the symlinks.
The files are loaded in numeric order, the structure of the configuration
has led to the following conventions in usage:
Files beginning with: Contain:
00 through 09 Font directories
10 through 19 system rendering defaults (AA, etc)
20 through 29 font rendering options
30 through 39 family substitution
40 through 49 generic identification, map family->generic
50 through 59 alternate config file loading
60 through 69 generic aliases, map generic->family
70 through 79 select font (adjust which fonts are available)
80 through 89 match target="scan" (modify scanned patterns)
90 through 99 font synthesis
squashfs-root/etc/fonts/fonts.conf
+115
View File
@@ -0,0 +1,115 @@
<?xml version="1.0"?>
<!DOCTYPE fontconfig SYSTEM "urn:fontconfig:fonts.dtd">
<!-- /etc/fonts/fonts.conf file to configure system font access -->
<fontconfig>
<description>Default configuration file</description>
<!--
DO NOT EDIT THIS FILE.
IT WILL BE REPLACED WHEN FONTCONFIG IS UPDATED.
LOCAL CHANGES BELONG IN 'local.conf'.
The intent of this standard configuration file is to be adequate for
most environments. If you have a reasonably normal environment and
have found problems with this configuration, they are probably
things that others will also want fixed. Please submit any problems
to the fontconfig issue tracking system located at fontconfig.org
Note that the normal 'make install' procedure for fontconfig is to
replace any existing fonts.conf file with the new version. Place
any local customizations in local.conf which this file references.
Keith Packard
-->
<!-- Font directory list -->
<dir>/usr/share/fonts</dir>
<dir>/usr/local/share/fonts</dir>
<dir prefix="xdg">fonts</dir>
<!-- the following element will be removed in the future -->
<dir>~/.fonts</dir>
<!--
Accept deprecated 'mono' alias, replacing it with 'monospace'
-->
<match target="pattern">
<test qual="any" name="family">
<string>mono</string>
</test>
<edit name="family" mode="assign" binding="same">
<string>monospace</string>
</edit>
</match>
<!--
Accept alternate 'sans serif' spelling, replacing it with 'sans-serif'
-->
<match target="pattern">
<test qual="any" name="family">
<string>sans serif</string>
</test>
<edit name="family" mode="assign" binding="same">
<string>sans-serif</string>
</edit>
</match>
<!--
Accept deprecated 'sans' alias, replacing it with 'sans-serif'
-->
<match target="pattern">
<test qual="any" name="family">
<string>sans</string>
</test>
<edit name="family" mode="assign" binding="same">
<string>sans-serif</string>
</edit>
</match>
<!--
Accept alternate 'system ui' spelling, replacing it with 'system-ui'
-->
<match target="pattern">
<test qual="any" name="family">
<string>system ui</string>
</test>
<edit name="family" mode="assign" binding="same">
<string>system-ui</string>
</edit>
</match>
<!--
Ignore dpkg temporary files created in fonts directories
-->
<selectfont>
<rejectfont>
<glob>*.dpkg-tmp</glob>
</rejectfont>
</selectfont>
<selectfont>
<rejectfont>
<glob>*.dpkg-new</glob>
</rejectfont>
</selectfont>
<!--
Load local system customization file
-->
<include ignore_missing="yes">conf.d</include>
<!-- Font cache directory list -->
<cachedir>/var/cache/fontconfig</cachedir>
<cachedir prefix="xdg">fontconfig</cachedir>
<!-- the following element will be removed in the future -->
<cachedir>~/.fontconfig</cachedir>
<config>
<!--
Rescan configuration every 30 seconds when FcFontSetList is called
-->
<rescan>
<int>30</int>
</rescan>
</config>
</fontconfig>
squashfs-root/etc/gnutls/config
+6
View File
@@ -0,0 +1,6 @@
[overrides]
disabled-version = tls1.0
disabled-version = tls1.1
disabled-version = dtls0.9
disabled-version = dtls1.0
squashfs-root/etc/init.d/dbus
Executable
+129
View File
@@ -0,0 +1,129 @@
#!/bin/sh
### BEGIN INIT INFO
# Provides: dbus
# Required-Start: $remote_fs $syslog
# Required-Stop: $remote_fs $syslog
# Default-Start: 2 3 4 5
# Default-Stop:
# Short-Description: D-Bus systemwide message bus
# Description: D-Bus is a simple interprocess messaging system, used
# for sending messages between applications.
### END INIT INFO
# -*- coding: utf-8 -*-
# Debian init.d script for D-BUS
# Copyright © 2003 Colin Walters <walters@debian.org>
# Copyright © 2005 Sjoerd Simons <sjoerd@debian.org>
set -e
DAEMON=/usr/bin/dbus-daemon
UUIDGEN=/usr/bin/dbus-uuidgen
UUIDGEN_OPTS=--ensure
NAME=dbus
DAEMONUSER=messagebus
PIDDIR=/var/run/dbus
PIDFILE=$PIDDIR/pid
DESC="system message bus"
test -x $DAEMON || exit 0
. /lib/lsb/init-functions
# Source defaults file; edit that file to configure this script.
PARAMS=""
if [ -e /etc/default/dbus ]; then
. /etc/default/dbus
fi
create_machineid() {
# Create machine-id file
if [ -x $UUIDGEN ]; then
$UUIDGEN $UUIDGEN_OPTS
fi
}
start_it_up()
{
if [ ! -d $PIDDIR ]; then
mkdir -p $PIDDIR
chown $DAEMONUSER $PIDDIR
chgrp $DAEMONUSER $PIDDIR
fi
if ! mountpoint -q /proc/ ; then
log_failure_msg "Can't start $DESC - /proc is not mounted"
return
fi
if [ -e $PIDFILE ]; then
if $0 status > /dev/null ; then
log_success_msg "$DESC already started; not starting."
return
else
log_success_msg "Removing stale PID file $PIDFILE."
rm -f $PIDFILE
fi
fi
create_machineid
# Force libnss-systemd to avoid trying to communicate via D-Bus, which
# is never going to work well from within dbus-daemon. systemd
# special-cases this internally, but we might need to do the same when
# booting with sysvinit if libnss-systemd is still installed.
# (Workaround for #940971)
export SYSTEMD_NSS_BYPASS_BUS=1
log_daemon_msg "Starting $DESC" "$NAME"
start-stop-daemon --start --quiet --pidfile $PIDFILE \
--exec $DAEMON -- --system $PARAMS
log_end_msg $?
}
shut_it_down()
{
log_daemon_msg "Stopping $DESC" "$NAME"
start-stop-daemon --stop --retry 5 --quiet --oknodo --pidfile $PIDFILE \
--user $DAEMONUSER
# We no longer include these arguments so that start-stop-daemon
# can do its job even given that we may have been upgraded.
# We rely on the pidfile being sanely managed
# --exec $DAEMON -- --system $PARAMS
log_end_msg $?
rm -f $PIDFILE
}
reload_it()
{
create_machineid
log_action_begin_msg "Reloading $DESC config"
dbus-send --print-reply --system --type=method_call \
--dest=org.freedesktop.DBus \
/ org.freedesktop.DBus.ReloadConfig > /dev/null
# hopefully this is enough time for dbus to reload it's config file.
log_action_end_msg $?
}
case "$1" in
start)
start_it_up
;;
stop)
shut_it_down
;;
reload|force-reload)
reload_it
;;
restart)
shut_it_down
start_it_up
;;
status)
status_of_proc -p $PIDFILE $DAEMON $NAME && exit 0 || exit $?
;;
*)
echo "Usage: /etc/init.d/$NAME {start|stop|reload|restart|force-reload|status}" >&2
exit 2
;;
esac
squashfs-root/etc/init.d/procps
Executable
+35
View File
@@ -0,0 +1,35 @@
#! /bin/sh
# kFreeBSD do not accept scripts as interpreters, using #!/bin/sh and sourcing.
if [ true != "$INIT_D_SCRIPT_SOURCED" ] ; then
set "$0" "$@"; INIT_D_SCRIPT_SOURCED=true . /lib/init/init-d-script
fi
### BEGIN INIT INFO
# Provides: procps
# Required-Start: mountkernfs $local_fs
# Required-Stop:
# Should-Start: udev module-init-tools
# X-Start-Before: $network
# Default-Start: S
# Default-Stop:
# Short-Description: Configure kernel parameters at boottime
# Description: Loads kernel parameters that are specified in /etc/sysctl.conf
### END INIT INFO
#
# written by Elrond <Elrond@Wunder-Nett.org>
DESC="Setting kernel variables"
DAEMON=/sbin/sysctl
PIDFILE=none
# Comment this out for sysctl to print every item changed
QUIET_SYSCTL="-q"
do_start_cmd() {
STATUS=0
$DAEMON $QUIET_SYSCTL --system || STATUS=$?
return $STATUS
}
do_reload() { call do_start_cmd; }
do_stop() { return 0; }
do_status() { return 0; }
squashfs-root/etc/ld.so.conf.d/x86_64-linux-gnu.conf
+4
View File
@@ -0,0 +1,4 @@
# Multiarch support
/usr/local/lib/x86_64-linux-gnu
/lib/x86_64-linux-gnu
/usr/lib/x86_64-linux-gnu
squashfs-root/etc/libaudit.conf
+7
View File
@@ -0,0 +1,7 @@
# This is the configuration file for libaudit tunables.
# It is currently only used for the failure_action tunable.
# failure_action can be: log, ignore, terminate
failure_action = ignore
squashfs-root/etc/mime.types
+2323
View File
File diff suppressed because it is too large. Load diff
squashfs-root/etc/modules-load.d/modules.conf
Symlink
+1
View File
@@ -0,0 +1 @@
../modules
squashfs-root/etc/pam.conf
+15
View File
@@ -0,0 +1,15 @@
# ---------------------------------------------------------------------------#
# /etc/pam.conf #
# ---------------------------------------------------------------------------#
#
# NOTE
# ----
#
# NOTE: Most program use a file under the /etc/pam.d/ directory to setup their
# PAM service modules. This file is used only if that directory does not exist.
# ---------------------------------------------------------------------------#
# Format:
# serv. module ctrl module [path] ...[args..] #
# name type flag #
squashfs-root/etc/pam.d/other
+16
View File
@@ -0,0 +1,16 @@
#
# /etc/pam.d/other - specify the PAM fallback behaviour
#
# Note that this file is used for any unspecified service; for example
#if /etc/pam.d/cron specifies no session modules but cron calls
#pam_open_session, the session module out of /etc/pam.d/other is
#used. If you really want nothing to happen then use pam_permit.so or
#pam_deny.so as appropriate.
# We fall back to the system default in /etc/pam.d/common-*
#
@include common-auth
@include common-account
@include common-password
@include common-session
squashfs-root/etc/pam.d/runuser
+5
View File
@@ -0,0 +1,5 @@
#%PAM-1.0
auth sufficient pam_rootok.so
session optional pam_keyinit.so revoke
session required pam_limits.so
session required pam_unix.so
squashfs-root/etc/pam.d/runuser-l
+5
View File
@@ -0,0 +1,5 @@
#%PAM-1.0
auth include runuser
session optional pam_keyinit.so force revoke
-session optional pam_systemd.so
session include runuser
squashfs-root/etc/pam.d/su
+61
View File
@@ -0,0 +1,61 @@
#
# The PAM configuration file for the Shadow `su' service
#
# This allows root to su without passwords (normal operation)
auth sufficient pam_rootok.so
# Uncomment this to force users to be a member of group wheel
# before they can use `su'. You can also add "group=foo"
# to the end of this line if you want to use a group other
# than the default "wheel" (but this may have side effect of
# denying "root" user, unless she's a member of "foo" or explicitly
# permitted earlier by e.g. "sufficient pam_rootok.so").
# (Replaces the `SU_WHEEL_ONLY' option from login.defs)
# auth required pam_wheel.so
# Uncomment this if you want wheel members to be able to
# su without a password.
# auth sufficient pam_wheel.so trust
# Uncomment this if you want members of a specific group to not
# be allowed to use su at all.
# auth required pam_wheel.so deny group=nosu
# Uncomment and edit /etc/security/time.conf if you need to set
# time restrainst on su usage.
# (Replaces the `PORTTIME_CHECKS_ENAB' option from login.defs
# as well as /etc/porttime)
# account requisite pam_time.so
# This module parses environment configuration file(s)
# and also allows you to use an extended config
# file /etc/security/pam_env.conf.
#
# parsing /etc/environment needs "readenv=1"
session required pam_env.so readenv=1
# locale variables are also kept into /etc/default/locale in etch
# reading this file *in addition to /etc/environment* does not hurt
session required pam_env.so readenv=1 envfile=/etc/default/locale
# Defines the MAIL environment variable
# However, userdel also needs MAIL_DIR and MAIL_FILE variables
# in /etc/login.defs to make sure that removing a user
# also removes the user's mail spool file.
# See comments in /etc/login.defs
#
# "nopen" stands to avoid reporting new mail when su'ing to another user
session optional pam_mail.so nopen
# Sets up user limits according to /etc/security/limits.conf
# (Replaces the use of /etc/limits in old login)
session required pam_limits.so
# The standard Unix authentication modules, used with
# NIS (man nsswitch) as well as normal /etc/passwd and
# /etc/shadow entries.
@include common-auth
@include common-account
@include common-session
squashfs-root/etc/pam.d/su-l
+6
View File
@@ -0,0 +1,6 @@
#%PAM-1.0
auth include su
account include su
password include su
session optional pam_keyinit.so force revoke
session include su
squashfs-root/etc/protocols
+68
View File
@@ -0,0 +1,68 @@
# Internet (IP) protocols
#
# Updated from http://www.iana.org/assignments/protocol-numbers and other
# sources.
# New protocols will be added on request if they have been officially
# assigned by IANA and are not historical.
# If you need a huge list of used numbers please install the nmap package.
ip 0 IP # internet protocol, pseudo protocol number
hopopt 0 HOPOPT # IPv6 Hop-by-Hop Option [RFC1883]
icmp 1 ICMP # internet control message protocol
igmp 2 IGMP # Internet Group Management
ggp 3 GGP # gateway-gateway protocol
ipencap 4 IP-ENCAP # IP encapsulated in IP (officially ``IP'')
st 5 ST # ST datagram mode
tcp 6 TCP # transmission control protocol
egp 8 EGP # exterior gateway protocol
igp 9 IGP # any private interior gateway (Cisco)
pup 12 PUP # PARC universal packet protocol
udp 17 UDP # user datagram protocol
hmp 20 HMP # host monitoring protocol
xns-idp 22 XNS-IDP # Xerox NS IDP
rdp 27 RDP # "reliable datagram" protocol
iso-tp4 29 ISO-TP4 # ISO Transport Protocol class 4 [RFC905]
dccp 33 DCCP # Datagram Congestion Control Prot. [RFC4340]
xtp 36 XTP # Xpress Transfer Protocol
ddp 37 DDP # Datagram Delivery Protocol
idpr-cmtp 38 IDPR-CMTP # IDPR Control Message Transport
ipv6 41 IPv6 # Internet Protocol, version 6
ipv6-route 43 IPv6-Route # Routing Header for IPv6
ipv6-frag 44 IPv6-Frag # Fragment Header for IPv6
idrp 45 IDRP # Inter-Domain Routing Protocol
rsvp 46 RSVP # Reservation Protocol
gre 47 GRE # General Routing Encapsulation
esp 50 IPSEC-ESP # Encap Security Payload [RFC2406]
ah 51 IPSEC-AH # Authentication Header [RFC2402]
skip 57 SKIP # SKIP
ipv6-icmp 58 IPv6-ICMP # ICMP for IPv6
ipv6-nonxt 59 IPv6-NoNxt # No Next Header for IPv6
ipv6-opts 60 IPv6-Opts # Destination Options for IPv6
rspf 73 RSPF CPHB # Radio Shortest Path First (officially CPHB)
vmtp 81 VMTP # Versatile Message Transport
eigrp 88 EIGRP # Enhanced Interior Routing Protocol (Cisco)
ospf 89 OSPFIGP # Open Shortest Path First IGP
ax.25 93 AX.25 # AX.25 frames
ipip 94 IPIP # IP-within-IP Encapsulation Protocol
etherip 97 ETHERIP # Ethernet-within-IP Encapsulation [RFC3378]
encap 98 ENCAP # Yet Another IP encapsulation [RFC1241]
# 99 # any private encryption scheme
pim 103 PIM # Protocol Independent Multicast
ipcomp 108 IPCOMP # IP Payload Compression Protocol
vrrp 112 VRRP # Virtual Router Redundancy Protocol [RFC5798]
l2tp 115 L2TP # Layer Two Tunneling Protocol [RFC2661]
isis 124 ISIS # IS-IS over IPv4
sctp 132 SCTP # Stream Control Transmission Protocol
fc 133 FC # Fibre Channel
mobility-header 135 Mobility-Header # Mobility Support for IPv6 [RFC3775]
udplite 136 UDPLite # UDP-Lite [RFC3828]
mpls-in-ip 137 MPLS-in-IP # MPLS-in-IP [RFC4023]
manet 138 # MANET Protocols [RFC5498]
hip 139 HIP # Host Identity Protocol
shim6 140 Shim6 # Shim6 Protocol [RFC5533]
wesp 141 WESP # Wrapped Encapsulating Security Payload
rohc 142 ROHC # Robust Header Compression
ethernet 143 Ethernet # Ethernet encapsulation for SRv6 [RFC8986]
# The following entries have not been assigned by IANA but are used
# internally by the Linux kernel.
mptcp 262 MPTCP # Multipath TCP connection
squashfs-root/etc/python3.12/sitecustomize.py
+7
View File
@@ -0,0 +1,7 @@
# install the apport exception handler if available
try:
import apport_python_hook
except ImportError:
pass
else:
apport_python_hook.install()
squashfs-root/etc/rpc
+41
View File
@@ -0,0 +1,41 @@
# This file contains user readable names that can be used in place of rpc
# program numbers.
portmapper 100000 portmap sunrpc rpcbind
rstatd 100001 rstat rstat_svc rup perfmeter
rusersd 100002 rusers
nfs 100003 nfsprog
ypserv 100004 ypprog
mountd 100005 mount showmount
ypbind 100007
walld 100008 rwall shutdown
yppasswdd 100009 yppasswd
etherstatd 100010 etherstat
rquotad 100011 rquotaprog quota rquota
sprayd 100012 spray
3270_mapper 100013
rje_mapper 100014
selection_svc 100015 selnsvc
database_svc 100016
rexd 100017 rex
alis 100018
sched 100019
llockmgr 100020
nlockmgr 100021
x25.inr 100022
statmon 100023
status 100024
bootparam 100026
ypupdated 100028 ypupdate
keyserv 100029 keyserver
tfsd 100037
nsed 100038
nsemntd 100039
ypxfrd 100069
nfs_acl 100227
pcnfsd 150001
amd 300019 amq
sgi_fam 391002
ugidd 545580417
fypxfrd 600100069 freebsd-ypxfrd
bwnfsd 788585389
squashfs-root/etc/security/access.conf
+122
View File
@@ -0,0 +1,122 @@
# Login access control table.
#
# Comment line must start with "#", no space at front.
# Order of lines is important.
#
# When someone logs in, the table is scanned for the first entry that
# matches the (user, host) combination, or, in case of non-networked
# logins, the first entry that matches the (user, tty) combination. The
# permissions field of that table entry determines whether the login will
# be accepted or refused.
#
# Format of the login access control table is three fields separated by a
# ":" character:
#
# [Note, if you supply a 'fieldsep=|' argument to the pam_access.so
# module, you can change the field separation character to be
# '|'. This is useful for configurations where you are trying to use
# pam_access with X applications that provide PAM_TTY values that are
# the display variable like "host:0".]
#
# permission:users:origins
#
# The first field should be a "+" (access granted) or "-" (access denied)
# character.
#
# The second field should be a list of one or more login names, group
# names, or ALL (always matches). A pattern of the form user@host is
# matched when the login name matches the "user" part, and when the
# "host" part matches the local machine name.
#
# The third field should be a list of one or more tty names (for
# non-networked logins), host names, domain names (begin with "."), host
# addresses, internet network numbers (end with "."), ALL (always
# matches), NONE (matches no tty on non-networked logins) or
# LOCAL (matches any string that does not contain a "." character).
#
# You can use @netgroupname in host or user patterns; this even works
# for @usergroup@@hostgroup patterns.
#
# The EXCEPT operator makes it possible to write very compact rules.
#
# The group file is searched only when a name does not match that of the
# logged-in user. Both the user's primary group is matched, as well as
# groups in which users are explicitly listed.
# To avoid problems with accounts, which have the same name as a group,
# you can use brackets around group names '(group)' to differentiate.
# In this case, you should also set the "nodefgroup" option.
#
# TTY NAMES: Must be in the form returned by ttyname(3) less the initial
# "/dev" (e.g. tty1 or vc/1)
#
##############################################################################
#
# Disallow non-root logins on tty1
#
#-:ALL EXCEPT root:tty1
#
# Disallow console logins to all but a few accounts.
#
#-:ALL EXCEPT wheel shutdown sync:LOCAL
#
# Same, but make sure that really the group wheel and not the user
# wheel is used (use nodefgroup argument, too):
#
#-:ALL EXCEPT (wheel) shutdown sync:LOCAL
#
# Disallow non-local logins to privileged accounts (group wheel).
#
#-:wheel:ALL EXCEPT LOCAL .win.tue.nl
#
# Some accounts are not allowed to login from anywhere:
#
#-:wsbscaro wsbsecr wsbspac wsbsym wscosor wstaiwde:ALL
#
# All other accounts are allowed to login from anywhere.
#
##############################################################################
# All lines from here up to the end are building a more complex example.
##############################################################################
#
# User "root" should be allowed to get access via cron .. tty5 tty6.
#+:root:cron crond :0 tty1 tty2 tty3 tty4 tty5 tty6
#
# User "root" should be allowed to get access from hosts with ip addresses.
#+:root:192.168.200.1 192.168.200.4 192.168.200.9
#+:root:127.0.0.1
#
# User "root" should get access from network 192.168.201.
# This term will be evaluated by string matching.
# comment: It might be better to use network/netmask instead.
# The same is 192.168.201.0/24 or 192.168.201.0/255.255.255.0
#+:root:192.168.201.
#
# User "root" should be able to have access from domain.
# Uses string matching also.
#+:root:.foo.bar.org
#
# User "root" should be denied to get access from all other sources.
#-:root:ALL
#
# User "foo" and members of netgroup "nis_group" should be
# allowed to get access from all sources.
# This will only work if netgroup service is available.
#+:@nis_group foo:ALL
#
# User "john" should get access from ipv4 net/mask
#+:john:127.0.0.0/24
#
# User "john" should get access from ipv4 as ipv6 net/mask
#+:john:::ffff:127.0.0.0/127
#
# User "john" should get access from ipv6 host address
#+:john:2001:4ca0:0:101::1
#
# User "john" should get access from ipv6 host address (same as above)
#+:john:2001:4ca0:0:101:0:0:0:1
#
# User "john" should get access from ipv6 net/mask
#+:john:2001:4ca0:0:101::/64
#
# All other users should be denied to get access from all sources.
#-:ALL:ALL
squashfs-root/etc/security/faillock.conf
+62
View File
@@ -0,0 +1,62 @@
# Configuration for locking the user after multiple failed
# authentication attempts.
#
# The directory where the user files with the failure records are kept.
# The default is /var/run/faillock.
# dir = /var/run/faillock
#
# Will log the user name into the system log if the user is not found.
# Enabled if option is present.
# audit
#
# Don't print informative messages.
# Enabled if option is present.
# silent
#
# Don't log informative messages via syslog.
# Enabled if option is present.
# no_log_info
#
# Only track failed user authentications attempts for local users
# in /etc/passwd and ignore centralized (AD, IdM, LDAP, etc.) users.
# The `faillock` command will also no longer track user failed
# authentication attempts. Enabling this option will prevent a
# double-lockout scenario where a user is locked out locally and
# in the centralized mechanism.
# Enabled if option is present.
# local_users_only
#
# Deny access if the number of consecutive authentication failures
# for this user during the recent interval exceeds n tries.
# The default is 3.
# deny = 3
#
# The length of the interval during which the consecutive
# authentication failures must happen for the user account
# lock out is <replaceable>n</replaceable> seconds.
# The default is 900 (15 minutes).
# fail_interval = 900
#
# The access will be re-enabled after n seconds after the lock out.
# The value 0 has the same meaning as value `never` - the access
# will not be re-enabled without resetting the faillock
# entries by the `faillock` command.
# The default is 600 (10 minutes).
# unlock_time = 600
#
# Root account can become locked as well as regular accounts.
# Enabled if option is present.
# even_deny_root
#
# This option implies the `even_deny_root` option.
# Allow access after n seconds to root account after the
# account is locked. In case the option is not specified
# the value is the same as of the `unlock_time` option.
# root_unlock_time = 900
#
# If a group name is specified with this option, members
# of the group will be handled by this module the same as
# the root account (the options `even_deny_root>` and
# `root_unlock_time` will apply to them.
# By default, the option is not set.
# admin_group = <admin_group_name>
squashfs-root/etc/security/group.conf
+106
View File
@@ -0,0 +1,106 @@
#
# This is the configuration file for the pam_group module.
#
#
# *** Please note that giving group membership on a session basis is
# *** NOT inherently secure. If a user can create an executable that
# *** is setgid a group that they are infrequently given membership
# *** of, they can basically obtain group membership any time they
# *** like. Example: games are allowed between the hours of 6pm and 6am
# *** user joe logs in at 7pm writes a small C-program toplay.c that
# *** invokes their favorite shell, compiles it and does
# *** "chgrp play toplay; chmod g+s toplay". They are basically able
# *** to play games any time... You have been warned. AGM
#
#
# The syntax of the lines is as follows:
#
# services;ttys;users;times;groups
#
# white space is ignored and lines maybe extended with '\\n' (escaped
# newlines). From reading these comments, it is clear that
# text following a '#' is ignored to the end of the line.
#
# the combination of individual users/terminals etc is a logic list
# namely individual tokens that are optionally prefixed with '!' (logical
# not) and separated with '&' (logical and) and '|' (logical or).
#
# services
# is a logic list of PAM service names that the rule applies to.
#
# ttys
# is a logic list of terminal names that this rule applies to.
#
# users
# is a logic list of users or a netgroup of users to whom this
# rule applies.
#
# NB. For these items the simple wildcard '*' may be used only once.
# With netgroups no wildcards or logic operators are allowed.
#
# times
# It is used to indicate "when" these groups are to be given to the
# user. The format here is a logic list of day/time-range
# entries the days are specified by a sequence of two character
# entries, MoTuSa for example is Monday Tuesday and Saturday. Note
# that repeated days are unset MoMo = no day, and MoWk = all weekdays
# bar Monday. The two character combinations accepted are
#
# Mo Tu We Th Fr Sa Su Wk Wd Al
#
# the last two being week-end days and all 7 days of the week
# respectively. As a final example, AlFr means all days except Friday.
#
# Each day/time-range can be prefixed with a '!' to indicate "anything
# but"
#
# The time-range part is two 24-hour times HHMM separated by a hyphen
# indicating the start and finish time (if the finish time is smaller
# than the start time it is deemed to apply on the following day).
#
# groups
# The (comma or space separated) list of groups that the user
# inherits membership of. These groups are added if the previous
# fields are satisfied by the user's request
#
# For a rule to be active, ALL of service+ttys+users must be satisfied
# by the applying process.
#
#
# Note, to get this to work as it is currently typed you need
#
# 1. to run an application as root
# 2. add the following groups to the /etc/group file:
# floppy, play, sound
#
#
# Here is a simple example: running 'xsh' on tty* (any ttyXXX device),
# the user 'us' is given access to the floppy (through membership of
# the floppy group)
#
#xsh;tty*&!ttyp*;us;Al0000-2400;floppy
#
# another example: running 'xsh' on tty* (any ttyXXX device),
# the user 'sword' is given access to games (through membership of
# the sound and play group) after work hours.
#
#xsh; tty* ;sword;!Wk0900-1800;sound, play
#xsh; tty* ;*;Al0900-1800;floppy
#
# yet another example: any member of the group 'admin' running
# 'xsh' on tty*, is granted access (at any time) to the group 'plugdev'
#
#xsh; tty* ;%admin;Al0000-2400;plugdev
#
# End of group.conf file
#
squashfs-root/etc/security/limits.conf
+67
View File
@@ -0,0 +1,67 @@
# /etc/security/limits.conf
#
#This file sets the resource limits for the users logged in via PAM.
#It does not affect resource limits of the system services.
#
#Also note that configuration files in /etc/security/limits.d directory,
#which are read in alphabetical order, override the settings in this
#file in case the domain is the same or more specific.
#That means, for example, that setting a limit for wildcard domain here
#can be overridden with a wildcard setting in a config file in the
#subdirectory, but a user specific setting here can be overridden only
#with a user specific setting in the subdirectory.
#
#Each line describes a limit for a user in the form:
#
#<domain> <type> <item> <value>
#
#Where:
#<domain> can be:
# - a user name
# - a group name, with @group syntax
# - the wildcard *, for default entry
# - the wildcard %, can be also used with %group syntax,
# for maxlogin limit
# - NOTE: group and wildcard limits are not applied to root.
# To apply a limit to the root user, <domain> must be
# the literal username root.
#
#<type> can have the two values:
# - "soft" for enforcing the soft limits
# - "hard" for enforcing hard limits
#
#<item> can be one of the following:
# - core - limits the core file size (KB)
# - data - max data size (KB)
# - fsize - maximum filesize (KB)
# - memlock - max locked-in-memory address space (KB)
# - nofile - max number of open file descriptors
# - rss - max resident set size (KB)
# - stack - max stack size (KB)
# - cpu - max CPU time (MIN)
# - nproc - max number of processes
# - as - address space limit (KB)
# - maxlogins - max number of logins for this user
# - maxsyslogins - max number of logins on the system
# - priority - the priority to run user process with
# - locks - max number of file locks the user can hold
# - sigpending - max number of pending signals
# - msgqueue - max memory used by POSIX message queues (bytes)
# - nice - max nice priority allowed to raise to values: [-20, 19]
# - rtprio - max realtime priority
# - chroot - change root to directory (Debian-specific)
#
#<domain> <type> <item> <value>
#
#* soft core 0
#root hard core 100000
#* hard rss 10000
#@student hard nproc 20
#@faculty soft nproc 20
#@faculty hard nproc 50
#ftp hard nproc 0
#ftp - chroot /ftp
#@student - maxlogins 4
# End of file
squashfs-root/etc/security/namespace.conf
+31
View File
@@ -0,0 +1,31 @@
# /etc/security/namespace.conf
#
# See /usr/share/doc/pam-*/txts/README.pam_namespace for more information.
#
# Uncommenting the following three lines will polyinstantiate
# /tmp, /var/tmp and user's home directories. /tmp and /var/tmp will
# be polyinstantiated based on the MLS level part of the security context as well as user
# name, Polyinstantion will not be performed for user root and adm for directories
# /tmp and /var/tmp, whereas home directories will be polyinstantiated for all users.
# The user name and context is appended to the instance prefix.
#
# Note that instance directories do not have to reside inside the
# polyinstantiated directory. In the examples below, instances of /tmp
# will be created in /tmp-inst directory, where as instances of /var/tmp
# and users home directories will reside within the directories that
# are being polyinstantiated.
#
# Instance parent directories must exist for the polyinstantiation
# mechanism to work. By default, they should be created with the mode
# of 000. pam_namespace module will enforce this mode unless it
# is explicitly called with an argument to ignore the mode of the
# instance parent. System administrators should use this argument with
# caution, as it will reduce security and isolation achieved by
# polyinstantiation. The parent directories (except $HOME) are created
# at boot by pam_namespace_helper, but in a live system, system
# administrators should create the parent directories before enabling
# them here.
#
#/tmp /tmp-inst/ level root,adm
#/var/tmp /var/tmp/tmp-inst/ level root,adm
#$HOME $HOME/$USER.inst/ level
squashfs-root/etc/security/namespace.init
Executable
+43
View File
@@ -0,0 +1,43 @@
#!/bin/sh
# It receives as arguments:
# - $1 polydir path (see WARNING below)
# - $2 instance path (see WARNING below)
# - $3 flag whether the instance dir was newly created (0 - no, 1 - yes)
# - $4 user name
# - $5 flag whether the polydir path ($1) is safe (0 - unsafe, 1 -safe)
# - $6 flag whether the instance path ($2) is safe (0 - unsafe, 1 - safe)
#
# WARNING: This script is invoked with full root privileges. Accessing
# the polydir ($1) and the instance ($2) directories in this context may be
# extremely dangerous as those can be under user control. The flags $5 and $6
# are provided to let you know if all the segments part of the path (except the
# last one) are owned by root and are writable by root only. If the path does
# not meet these criteria, you expose yourself to possible symlink attacks when
# accessing these path.
# However, even if the path components are safe, the content of the
# directories may still be owned/writable by a user, so care must be taken!
#
# The following section will copy the contents of /etc/skel if this is a
# newly created home directory.
# Executes only if the polydir path is safe
if [ "$5" = 1 ]; then
if [ "$3" = 1 ]; then
# This line will fix the labeling on all newly created directories
[ -x /sbin/restorecon ] && /sbin/restorecon "$1"
user="$4"
passwd=$(getent passwd "$user")
homedir=$(echo "$passwd" | cut -f6 -d":")
if [ "$1" = "$homedir" ]; then
gid=$(echo "$passwd" | cut -f4 -d":")
cp -rT /etc/skel "$homedir"
chown -R "$user":"$gid" "$homedir"
mask=$(sed -E -n 's/^UMASK[[:space:]]+([^#[:space:]]+).*/\1/p' /etc/login.defs)
mode=$(printf "%o" $((0777 & ~mask)))
chmod ${mode:-700} "$homedir"
[ -x /sbin/restorecon ] && /sbin/restorecon -R "$homedir"
fi
fi
fi
exit 0
squashfs-root/etc/security/pam_env.conf
+73
View File
@@ -0,0 +1,73 @@
#
# This is the configuration file for pam_env, a PAM module to load in
# a configurable list of environment variables for a
#
# The original idea for this came from Andrew G. Morgan ...
#<quote>
# Mmm. Perhaps you might like to write a pam_env module that reads a
# default environment from a file? I can see that as REALLY
# useful... Note it would be an "auth" module that returns PAM_IGNORE
# for the auth part and sets the environment returning PAM_SUCCESS in
# the setcred function...
#</quote>
#
# What I wanted was the REMOTEHOST variable set, purely for selfish
# reasons, and AGM didn't want it added to the SimpleApps login
# program (which is where I added the patch). So, my first concern is
# that variable, from there there are numerous others that might/would
# be useful to be set: NNTPSERVER, LESS, PATH, PAGER, MANPAGER .....
#
# Of course, these are a different kind of variable than REMOTEHOST in
# that they are things that are likely to be configured by
# administrators rather than set by logging in, how to treat them both
# in the same config file?
#
# Here is my idea:
#
# Each line starts with the variable name, there are then two possible
# options for each variable DEFAULT and OVERRIDE.
# DEFAULT allows an administrator to set the value of the
# variable to some default value, if none is supplied then the empty
# string is assumed. The OVERRIDE option tells pam_env that it should
# enter in its value (overriding the default value) if there is one
# to use. OVERRIDE is not used, "" is assumed and no override will be
# done.
#
# VARIABLE [DEFAULT=[value]] [OVERRIDE=[value]]
#
# (Possibly non-existent) environment variables may be used in values
# using the ${string} syntax and (possibly non-existent) PAM_ITEMs may
# be used in values using the @{string} syntax. Both the $ and @
# characters can be backslash escaped to be used as literal values
# values can be delimited with "", escaped " not supported.
# Note that many environment variables that you would like to use
# may not be set by the time the module is called.
# For example, HOME is used below several times, but
# many PAM applications don't make it available by the time you need it.
#
#
# First, some special variables
#
# Set the REMOTEHOST variable for any hosts that are remote, default
# to "localhost" rather than not being set at all
#REMOTEHOST DEFAULT=localhost OVERRIDE=@{PAM_RHOST}
#
# Set the DISPLAY variable if it seems reasonable
#DISPLAY DEFAULT=${REMOTEHOST}:0.0 OVERRIDE=${DISPLAY}
#
#
# Now some simple variables
#
#PAGER DEFAULT=less
#MANPAGER DEFAULT=less
#LESS DEFAULT="M q e h15 z23 b80"
#NNTPSERVER DEFAULT=localhost
#PATH DEFAULT=${HOME}/bin:/usr/local/bin:/bin\
#:/usr/bin:/usr/local/bin/X11:/usr/bin/X11
#
# silly examples of escaped variables, just to show how they work.
#
#DOLLAR DEFAULT=\$
#DOLLARDOLLAR DEFAULT= OVERRIDE=\$${DOLLAR}
#DOLLARPLUS DEFAULT=\${REMOTEHOST}${REMOTEHOST}
#ATSIGN DEFAULT="" OVERRIDE=\@
squashfs-root/etc/security/pwhistory.conf
+21
View File
@@ -0,0 +1,21 @@
# Configuration for remembering the last passwords used by a user.
#
# Enable the debugging logs.
# Enabled if option is present.
# debug
#
# root account's passwords are also remembered.
# Enabled if option is present.
# enforce_for_root
#
# Number of passwords to remember.
# The default is 10.
# remember = 10
#
# Number of times to prompt for the password.
# The default is 1.
# retry = 1
#
# The directory where the last passwords are kept.
# The default is /etc/security/opasswd.
# file = /etc/security/opasswd
squashfs-root/etc/security/sepermit.conf
+11
View File
@@ -0,0 +1,11 @@
# /etc/security/sepermit.conf
#
# Each line contains either:
# - a user name
# - a group name, with @group syntax
# - a SELinux user name, with %seuser syntax
# Each line can contain optional arguments separated by :
# The possible arguments are:
# - exclusive - only single login session will
# be allowed for the user and the user's processes
# will be killed on logout
squashfs-root/etc/security/time.conf
+65
View File
@@ -0,0 +1,65 @@
# this is an example configuration file for the pam_time module. Its syntax
# was initially based heavily on that of the shadow package (shadow-960129).
#
# the syntax of the lines is as follows:
#
# services;ttys;users;times
#
# white space is ignored and lines maybe extended with '\\n' (escaped
# newlines). As should be clear from reading these comments,
# text following a '#' is ignored to the end of the line.
#
# the combination of individual users/terminals etc is a logic list
# namely individual tokens that are optionally prefixed with '!' (logical
# not) and separated with '&' (logical and) and '|' (logical or).
#
# services
# is a logic list of PAM service names that the rule applies to.
#
# ttys
# is a logic list of terminal names that this rule applies to.
#
# users
# is a logic list of users or a netgroup of users to whom this
# rule applies.
#
# NB. For these items the simple wildcard '*' may be used only once.
#
# times
# the format here is a logic list of day/time-range
# entries the days are specified by a sequence of two character
# entries, MoTuSa for example is Monday Tuesday and Saturday. Note
# that repeated days are unset MoMo = no day, and MoWk = all weekdays
# bar Monday. The two character combinations accepted are
#
# Mo Tu We Th Fr Sa Su Wk Wd Al
#
# the last two being week-end days and all 7 days of the week
# respectively. As a final example, AlFr means all days except Friday.
#
# each day/time-range can be prefixed with a '!' to indicate "anything
# but"
#
# The time-range part is two 24-hour times HHMM separated by a hyphen
# indicating the start and finish time (if the finish time is smaller
# than the start time it is deemed to apply on the following day).
#
# for a rule to be active, ALL of service+ttys+users must be satisfied
# by the applying process.
#
#
# Here is a simple example: running blank on tty* (any ttyXXX device),
# the users 'you' and 'me' are denied service all of the time
#
#blank;tty* & !ttyp*;you|me;!Al0000-2400
# Another silly example, user 'root' is denied xsh access
# from pseudo terminals at the weekend and on mondays.
#xsh;ttyp*;root;!WdMo0000-2400
#
# End of example file.
#
squashfs-root/etc/services
+361
View File
@@ -0,0 +1,361 @@
# Network services, Internet style
#
# Updated from https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml .
#
# New ports will be added on request if they have been officially assigned
# by IANA and used in the real-world or are needed by a debian package.
# If you need a huge list of used numbers please install the nmap package.
tcpmux 1/tcp # TCP port service multiplexer
echo 7/tcp
echo 7/udp
discard 9/tcp sink null
discard 9/udp sink null
systat 11/tcp users
daytime 13/tcp
daytime 13/udp
netstat 15/tcp
qotd 17/tcp quote
chargen 19/tcp ttytst source
chargen 19/udp ttytst source
ftp-data 20/tcp
ftp 21/tcp
fsp 21/udp fspd
ssh 22/tcp # SSH Remote Login Protocol
telnet 23/tcp
smtp 25/tcp mail
time 37/tcp timserver
time 37/udp timserver
whois 43/tcp nicname
tacacs 49/tcp # Login Host Protocol (TACACS)
tacacs 49/udp
domain 53/tcp # Domain Name Server
domain 53/udp
bootps 67/udp
bootpc 68/udp
tftp 69/udp
gopher 70/tcp # Internet Gopher
finger 79/tcp
http 80/tcp www # WorldWideWeb HTTP
kerberos 88/tcp kerberos5 krb5 kerberos-sec # Kerberos v5
kerberos 88/udp kerberos5 krb5 kerberos-sec # Kerberos v5
iso-tsap 102/tcp tsap # part of ISODE
acr-nema 104/tcp dicom # Digital Imag. & Comm. 300
pop3 110/tcp pop-3 # POP version 3
sunrpc 111/tcp portmapper # RPC 4.0 portmapper
sunrpc 111/udp portmapper
auth 113/tcp authentication tap ident
nntp 119/tcp readnews untp # USENET News Transfer Protocol
ntp 123/udp # Network Time Protocol
epmap 135/tcp loc-srv # DCE endpoint resolution
netbios-ns 137/udp # NETBIOS Name Service
netbios-dgm 138/udp # NETBIOS Datagram Service
netbios-ssn 139/tcp # NETBIOS session service
imap2 143/tcp imap # Interim Mail Access P 2 and 4
snmp 161/tcp # Simple Net Mgmt Protocol
snmp 161/udp
snmp-trap 162/tcp snmptrap # Traps for SNMP
snmp-trap 162/udp snmptrap
cmip-man 163/tcp # ISO mgmt over IP (CMOT)
cmip-man 163/udp
cmip-agent 164/tcp
cmip-agent 164/udp
mailq 174/tcp # Mailer transport queue for Zmailer
xdmcp 177/udp # X Display Manager Control Protocol
bgp 179/tcp # Border Gateway Protocol
smux 199/tcp # SNMP Unix Multiplexer
qmtp 209/tcp # Quick Mail Transfer Protocol
z3950 210/tcp wais # NISO Z39.50 database
ipx 213/udp # IPX [RFC1234]
ptp-event 319/udp
ptp-general 320/udp
pawserv 345/tcp # Perf Analysis Workbench
zserv 346/tcp # Zebra server
rpc2portmap 369/tcp
rpc2portmap 369/udp # Coda portmapper
codaauth2 370/tcp
codaauth2 370/udp # Coda authentication server
clearcase 371/udp Clearcase
ldap 389/tcp # Lightweight Directory Access Protocol
ldap 389/udp
svrloc 427/tcp # Server Location
svrloc 427/udp
https 443/tcp # http protocol over TLS/SSL
https 443/udp # HTTP/3
snpp 444/tcp # Simple Network Paging Protocol
microsoft-ds 445/tcp # Microsoft Naked CIFS
kpasswd 464/tcp
kpasswd 464/udp
submissions 465/tcp ssmtp smtps urd # Submission over TLS [RFC8314]
saft 487/tcp # Simple Asynchronous File Transfer
isakmp 500/udp # IPSEC key management
rtsp 554/tcp # Real Time Stream Control Protocol
rtsp 554/udp
nqs 607/tcp # Network Queuing system
asf-rmcp 623/udp # ASF Remote Management and Control Protocol
qmqp 628/tcp
ipp 631/tcp # Internet Printing Protocol
ldp 646/tcp # Label Distribution Protocol
ldp 646/udp
#
# UNIX specific services
#
exec 512/tcp
biff 512/udp comsat
login 513/tcp
who 513/udp whod
shell 514/tcp cmd syslog # no passwords used
syslog 514/udp
printer 515/tcp spooler # line printer spooler
talk 517/udp
ntalk 518/udp
route 520/udp router routed # RIP
gdomap 538/tcp # GNUstep distributed objects
gdomap 538/udp
uucp 540/tcp uucpd # uucp daemon
klogin 543/tcp # Kerberized `rlogin' (v5)
kshell 544/tcp krcmd # Kerberized `rsh' (v5)
dhcpv6-client 546/udp
dhcpv6-server 547/udp
afpovertcp 548/tcp # AFP over TCP
nntps 563/tcp snntp # NNTP over SSL
submission 587/tcp # Submission [RFC4409]
ldaps 636/tcp # LDAP over SSL
ldaps 636/udp
tinc 655/tcp # tinc control port
tinc 655/udp
silc 706/tcp
kerberos-adm 749/tcp # Kerberos `kadmin' (v5)
#
domain-s 853/tcp # DNS over TLS [RFC7858]
domain-s 853/udp # DNS over DTLS [RFC8094]
rsync 873/tcp
ftps-data 989/tcp # FTP over SSL (data)
ftps 990/tcp
telnets 992/tcp # Telnet over SSL
imaps 993/tcp # IMAP over SSL
pop3s 995/tcp # POP-3 over SSL
#
# From ``Assigned Numbers'':
#
#> The Registered Ports are not controlled by the IANA and on most systems
#> can be used by ordinary user processes or programs executed by ordinary
#> users.
#
#> Ports are used in the TCP [45,106] to name the ends of logical
#> connections which carry long term conversations. For the purpose of
#> providing services to unknown callers, a service contact port is
#> defined. This list specifies the port used by the server process as its
#> contact port. While the IANA can not control uses of these ports it
#> does register or list uses of these ports as a convienence to the
#> community.
#
socks 1080/tcp # socks proxy server
proofd 1093/tcp
rootd 1094/tcp
openvpn 1194/tcp
openvpn 1194/udp
rmiregistry 1099/tcp # Java RMI Registry
lotusnote 1352/tcp lotusnotes # Lotus Note
ms-sql-s 1433/tcp # Microsoft SQL Server
ms-sql-m 1434/udp # Microsoft SQL Monitor
ingreslock 1524/tcp
datametrics 1645/tcp old-radius
datametrics 1645/udp old-radius
sa-msg-port 1646/tcp old-radacct
sa-msg-port 1646/udp old-radacct
kermit 1649/tcp
groupwise 1677/tcp
l2f 1701/udp l2tp
radius 1812/tcp
radius 1812/udp
radius-acct 1813/tcp radacct # Radius Accounting
radius-acct 1813/udp radacct
cisco-sccp 2000/tcp # Cisco SCCP
nfs 2049/tcp # Network File System
nfs 2049/udp # Network File System
gnunet 2086/tcp
gnunet 2086/udp
rtcm-sc104 2101/tcp # RTCM SC-104 IANA 1/29/99
rtcm-sc104 2101/udp
gsigatekeeper 2119/tcp
gris 2135/tcp # Grid Resource Information Server
cvspserver 2401/tcp # CVS client/server operations
venus 2430/tcp # codacon port
venus 2430/udp # Venus callback/wbc interface
venus-se 2431/tcp # tcp side effects
venus-se 2431/udp # udp sftp side effect
codasrv 2432/tcp # not used
codasrv 2432/udp # server port
codasrv-se 2433/tcp # tcp side effects
codasrv-se 2433/udp # udp sftp side effect
mon 2583/tcp # MON traps
mon 2583/udp
dict 2628/tcp # Dictionary server
f5-globalsite 2792/tcp
gsiftp 2811/tcp
gpsd 2947/tcp
gds-db 3050/tcp gds_db # InterBase server
icpv2 3130/udp icp # Internet Cache Protocol
isns 3205/tcp # iSNS Server Port
isns 3205/udp # iSNS Server Port
iscsi-target 3260/tcp
mysql 3306/tcp
ms-wbt-server 3389/tcp
nut 3493/tcp # Network UPS Tools
nut 3493/udp
distcc 3632/tcp # distributed compiler
daap 3689/tcp # Digital Audio Access Protocol
svn 3690/tcp subversion # Subversion protocol
suucp 4031/tcp # UUCP over SSL
sysrqd 4094/tcp # sysrq daemon
sieve 4190/tcp # ManageSieve Protocol
epmd 4369/tcp # Erlang Port Mapper Daemon
remctl 4373/tcp # Remote Authenticated Command Service
f5-iquery 4353/tcp # F5 iQuery
ntske 4460/tcp # Network Time Security Key Establishment
ipsec-nat-t 4500/udp # IPsec NAT-Traversal [RFC3947]
iax 4569/udp # Inter-Asterisk eXchange
mtn 4691/tcp # monotone Netsync Protocol
radmin-port 4899/tcp # RAdmin Port
sip 5060/tcp # Session Initiation Protocol
sip 5060/udp
sip-tls 5061/tcp
sip-tls 5061/udp
xmpp-client 5222/tcp jabber-client # Jabber Client Connection
xmpp-server 5269/tcp jabber-server # Jabber Server Connection
cfengine 5308/tcp
mdns 5353/udp # Multicast DNS
postgresql 5432/tcp postgres # PostgreSQL Database
freeciv 5556/tcp rptp # Freeciv gameplay
amqps 5671/tcp # AMQP protocol over TLS/SSL
amqp 5672/tcp
amqp 5672/sctp
x11 6000/tcp x11-0 # X Window System
x11-1 6001/tcp
x11-2 6002/tcp
x11-3 6003/tcp
x11-4 6004/tcp
x11-5 6005/tcp
x11-6 6006/tcp
x11-7 6007/tcp
gnutella-svc 6346/tcp # gnutella
gnutella-svc 6346/udp
gnutella-rtr 6347/tcp # gnutella
gnutella-rtr 6347/udp
redis 6379/tcp
sge-qmaster 6444/tcp sge_qmaster # Grid Engine Qmaster Service
sge-execd 6445/tcp sge_execd # Grid Engine Execution Service
mysql-proxy 6446/tcp # MySQL Proxy
babel 6696/udp # Babel Routing Protocol
ircs-u 6697/tcp # Internet Relay Chat via TLS/SSL
bbs 7000/tcp
afs3-fileserver 7000/udp
afs3-callback 7001/udp # callbacks to cache managers
afs3-prserver 7002/udp # users & groups database
afs3-vlserver 7003/udp # volume location database
afs3-kaserver 7004/udp # AFS/Kerberos authentication
afs3-volser 7005/udp # volume managment server
afs3-bos 7007/udp # basic overseer process
afs3-update 7008/udp # server-to-server updater
afs3-rmtsys 7009/udp # remote cache manager service
font-service 7100/tcp xfs # X Font Service
http-alt 8080/tcp webcache # WWW caching service
puppet 8140/tcp # The Puppet master service
bacula-dir 9101/tcp # Bacula Director
bacula-fd 9102/tcp # Bacula File Daemon
bacula-sd 9103/tcp # Bacula Storage Daemon
xmms2 9667/tcp # Cross-platform Music Multiplexing System
nbd 10809/tcp # Linux Network Block Device
zabbix-agent 10050/tcp # Zabbix Agent
zabbix-trapper 10051/tcp # Zabbix Trapper
amanda 10080/tcp # amanda backup services
dicom 11112/tcp
hkp 11371/tcp # OpenPGP HTTP Keyserver
db-lsp 17500/tcp # Dropbox LanSync Protocol
dcap 22125/tcp # dCache Access Protocol
gsidcap 22128/tcp # GSI dCache Access Protocol
wnn6 22273/tcp # wnn6
#
# Datagram Delivery Protocol services
#
rtmp 1/ddp # Routing Table Maintenance Protocol
nbp 2/ddp # Name Binding Protocol
echo 4/ddp # AppleTalk Echo Protocol
zip 6/ddp # Zone Information Protocol
#=========================================================================
# The remaining port numbers are not as allocated by IANA.
#=========================================================================
# Kerberos (Project Athena/MIT) services
kerberos4 750/udp kerberos-iv kdc # Kerberos (server)
kerberos4 750/tcp kerberos-iv kdc
kerberos-master 751/udp kerberos_master # Kerberos authentication
kerberos-master 751/tcp
passwd-server 752/udp passwd_server # Kerberos passwd server
krb-prop 754/tcp krb_prop krb5_prop hprop # Kerberos slave propagation
zephyr-srv 2102/udp # Zephyr server
zephyr-clt 2103/udp # Zephyr serv-hm connection
zephyr-hm 2104/udp # Zephyr hostmanager
iprop 2121/tcp # incremental propagation
supfilesrv 871/tcp # Software Upgrade Protocol server
supfiledbg 1127/tcp # Software Upgrade Protocol debugging
#
# Services added for the Debian GNU/Linux distribution
#
poppassd 106/tcp # Eudora
moira-db 775/tcp moira_db # Moira database
moira-update 777/tcp moira_update # Moira update protocol
moira-ureg 779/udp moira_ureg # Moira user registration
spamd 783/tcp # spamassassin daemon
skkserv 1178/tcp # skk jisho server port
predict 1210/udp # predict -- satellite tracking
rmtcfg 1236/tcp # Gracilis Packeten remote config server
xtel 1313/tcp # french minitel
xtelw 1314/tcp # french minitel
zebrasrv 2600/tcp # zebra service
zebra 2601/tcp # zebra vty
ripd 2602/tcp # ripd vty (zebra)
ripngd 2603/tcp # ripngd vty (zebra)
ospfd 2604/tcp # ospfd vty (zebra)
bgpd 2605/tcp # bgpd vty (zebra)
ospf6d 2606/tcp # ospf6d vty (zebra)
ospfapi 2607/tcp # OSPF-API
isisd 2608/tcp # ISISd vty (zebra)
fax 4557/tcp # FAX transmission service (old)
hylafax 4559/tcp # HylaFAX client-server protocol (new)
munin 4949/tcp lrrd # Munin
rplay 5555/udp # RPlay audio service
nrpe 5666/tcp # Nagios Remote Plugin Executor
nsca 5667/tcp # Nagios Agent - NSCA
canna 5680/tcp # cannaserver
syslog-tls 6514/tcp # Syslog over TLS [RFC5425]
sane-port 6566/tcp sane saned # SANE network scanner daemon
ircd 6667/tcp # Internet Relay Chat
zope-ftp 8021/tcp # zope management by ftp
tproxy 8081/tcp # Transparent Proxy
omniorb 8088/tcp # OmniORB
clc-build-daemon 8990/tcp # Common lisp build daemon
xinetd 9098/tcp
git 9418/tcp # Git Version Control System
zope 9673/tcp # zope server
webmin 10000/tcp
kamanda 10081/tcp # amanda backup services (Kerberos)
amandaidx 10082/tcp # amanda backup services
amidxtape 10083/tcp # amanda backup services
sgi-cmsd 17001/udp # Cluster membership services daemon
sgi-crsd 17002/udp
sgi-gcd 17003/udp # SGI Group membership daemon
sgi-cad 17004/tcp # Cluster Admin daemon
binkp 24554/tcp # binkp fidonet protocol
asp 27374/tcp # Address Search Protocol
asp 27374/udp
csync2 30865/tcp # cluster synchronization tool
dircproxy 57000/tcp # Detachable IRC Proxy
tfido 60177/tcp # fidonet EMSI over telnet
fido 60179/tcp # fidonet EMSI over TCP
# Local services
squashfs-root/etc/ssl/openssl.cnf
+390
View File
@@ -0,0 +1,390 @@
#
# OpenSSL example configuration file.
# See doc/man5/config.pod for more info.
#
# This is mostly being used for generation of certificate requests,
# but may be used for auto loading of providers
# Note that you can include other files from the main configuration
# file using the .include directive.
#.include filename
# This definition stops the following lines choking if HOME isn't
# defined.
HOME = .
# Use this in order to automatically load providers.
openssl_conf = openssl_init
# Comment out the next line to ignore configuration errors
config_diagnostics = 1
# Extra OBJECT IDENTIFIER info:
# oid_file = $ENV::HOME/.oid
oid_section = new_oids
# To use this configuration file with the "-extfile" option of the
# "openssl x509" utility, name here the section containing the
# X.509v3 extensions to use:
# extensions =
# (Alternatively, use a configuration file that has only
# X.509v3 extensions in its main [= default] section.)
[ new_oids ]
# We can add new OIDs in here for use by 'ca', 'req' and 'ts'.
# Add a simple OID like this:
# testoid1=1.2.3.4
# Or use config file substitution like this:
# testoid2=${testoid1}.5.6
# Policies used by the TSA examples.
tsa_policy1 = 1.2.3.4.1
tsa_policy2 = 1.2.3.4.5.6
tsa_policy3 = 1.2.3.4.5.7
# For FIPS
# Optionally include a file that is generated by the OpenSSL fipsinstall
# application. This file contains configuration data required by the OpenSSL
# fips provider. It contains a named section e.g. [fips_sect] which is
# referenced from the [provider_sect] below.
# Refer to the OpenSSL security policy for more information.
# .include fipsmodule.cnf
[openssl_init]
providers = provider_sect
# List of providers to load
[provider_sect]
default = default_sect
# The fips section name should match the section name inside the
# included fipsmodule.cnf.
# fips = fips_sect
# If no providers are activated explicitly, the default one is activated implicitly.
# See man 7 OSSL_PROVIDER-default for more details.
#
# If you add a section explicitly activating any other provider(s), you most
# probably need to explicitly activate the default provider, otherwise it
# becomes unavailable in openssl. As a consequence applications depending on
# OpenSSL may not work correctly which could lead to significant system
# problems including inability to remotely access the system.
[default_sect]
# activate = 1
####################################################################
[ ca ]
default_ca = CA_default # The default ca section
####################################################################
[ CA_default ]
dir = ./demoCA # Where everything is kept
certs = $dir/certs # Where the issued certs are kept
crl_dir = $dir/crl # Where the issued crl are kept
database = $dir/index.txt # database index file.
#unique_subject = no # Set to 'no' to allow creation of
# several certs with same subject.
new_certs_dir = $dir/newcerts # default place for new certs.
certificate = $dir/cacert.pem # The CA certificate
serial = $dir/serial # The current serial number
crlnumber = $dir/crlnumber # the current crl number
# must be commented out to leave a V1 CRL
crl = $dir/crl.pem # The current CRL
private_key = $dir/private/cakey.pem# The private key
x509_extensions = usr_cert # The extensions to add to the cert
# Comment out the following two lines for the "traditional"
# (and highly broken) format.
name_opt = ca_default # Subject Name options
cert_opt = ca_default # Certificate field options
# Extension copying option: use with caution.
# copy_extensions = copy
# Extensions to add to a CRL. Note: Netscape communicator chokes on V2 CRLs
# so this is commented out by default to leave a V1 CRL.
# crlnumber must also be commented out to leave a V1 CRL.
# crl_extensions = crl_ext
default_days = 365 # how long to certify for
default_crl_days= 30 # how long before next CRL
default_md = default # use public key default MD
preserve = no # keep passed DN ordering
# A few difference way of specifying how similar the request should look
# For type CA, the listed attributes must be the same, and the optional
# and supplied fields are just that :-)
policy = policy_match
# For the CA policy
[ policy_match ]
countryName = match
stateOrProvinceName = match
organizationName = match
organizationalUnitName = optional
commonName = supplied
emailAddress = optional
# For the 'anything' policy
# At this point in time, you must list all acceptable 'object'
# types.
[ policy_anything ]
countryName = optional
stateOrProvinceName = optional
localityName = optional
organizationName = optional
organizationalUnitName = optional
commonName = supplied
emailAddress = optional
####################################################################
[ req ]
default_bits = 2048
default_keyfile = privkey.pem
distinguished_name = req_distinguished_name
attributes = req_attributes
x509_extensions = v3_ca # The extensions to add to the self signed cert
# Passwords for private keys if not present they will be prompted for
# input_password = secret
# output_password = secret
# This sets a mask for permitted string types. There are several options.
# default: PrintableString, T61String, BMPString.
# pkix : PrintableString, BMPString (PKIX recommendation before 2004)
# utf8only: only UTF8Strings (PKIX recommendation after 2004).
# nombstr : PrintableString, T61String (no BMPStrings or UTF8Strings).
# MASK:XXXX a literal mask value.
# WARNING: ancient versions of Netscape crash on BMPStrings or UTF8Strings.
string_mask = utf8only
# req_extensions = v3_req # The extensions to add to a certificate request
[ req_distinguished_name ]
countryName = Country Name (2 letter code)
countryName_default = AU
countryName_min = 2
countryName_max = 2
stateOrProvinceName = State or Province Name (full name)
stateOrProvinceName_default = Some-State
localityName = Locality Name (eg, city)
0.organizationName = Organization Name (eg, company)
0.organizationName_default = Internet Widgits Pty Ltd
# we can do this but it is not needed normally :-)
#1.organizationName = Second Organization Name (eg, company)
#1.organizationName_default = World Wide Web Pty Ltd
organizationalUnitName = Organizational Unit Name (eg, section)
#organizationalUnitName_default =
commonName = Common Name (e.g. server FQDN or YOUR name)
commonName_max = 64
emailAddress = Email Address
emailAddress_max = 64
# SET-ex3 = SET extension number 3
[ req_attributes ]
challengePassword = A challenge password
challengePassword_min = 4
challengePassword_max = 20
unstructuredName = An optional company name
[ usr_cert ]
# These extensions are added when 'ca' signs a request.
# This goes against PKIX guidelines but some CAs do it and some software
# requires this to avoid interpreting an end user certificate as a CA.
basicConstraints=CA:FALSE
# This is typical in keyUsage for a client certificate.
# keyUsage = nonRepudiation, digitalSignature, keyEncipherment
# PKIX recommendations harmless if included in all certificates.
subjectKeyIdentifier=hash
authorityKeyIdentifier=keyid,issuer
# This stuff is for subjectAltName and issuerAltname.
# Import the email address.
# subjectAltName=email:copy
# An alternative to produce certificates that aren't
# deprecated according to PKIX.
# subjectAltName=email:move
# Copy subject details
# issuerAltName=issuer:copy
# This is required for TSA certificates.
# extendedKeyUsage = critical,timeStamping
[ v3_req ]
# Extensions to add to a certificate request
basicConstraints = CA:FALSE
keyUsage = nonRepudiation, digitalSignature, keyEncipherment
[ v3_ca ]
# Extensions for a typical CA
# PKIX recommendation.
subjectKeyIdentifier=hash
authorityKeyIdentifier=keyid:always,issuer
basicConstraints = critical,CA:true
# Key usage: this is typical for a CA certificate. However since it will
# prevent it being used as an test self-signed certificate it is best
# left out by default.
# keyUsage = cRLSign, keyCertSign
# Include email address in subject alt name: another PKIX recommendation
# subjectAltName=email:copy
# Copy issuer details
# issuerAltName=issuer:copy
# DER hex encoding of an extension: beware experts only!
# obj=DER:02:03
# Where 'obj' is a standard or added object
# You can even override a supported extension:
# basicConstraints= critical, DER:30:03:01:01:FF
[ crl_ext ]
# CRL extensions.
# Only issuerAltName and authorityKeyIdentifier make any sense in a CRL.
# issuerAltName=issuer:copy
authorityKeyIdentifier=keyid:always
[ proxy_cert_ext ]
# These extensions should be added when creating a proxy certificate
# This goes against PKIX guidelines but some CAs do it and some software
# requires this to avoid interpreting an end user certificate as a CA.
basicConstraints=CA:FALSE
# This is typical in keyUsage for a client certificate.
# keyUsage = nonRepudiation, digitalSignature, keyEncipherment
# PKIX recommendations harmless if included in all certificates.
subjectKeyIdentifier=hash
authorityKeyIdentifier=keyid,issuer
# This stuff is for subjectAltName and issuerAltname.
# Import the email address.
# subjectAltName=email:copy
# An alternative to produce certificates that aren't
# deprecated according to PKIX.
# subjectAltName=email:move
# Copy subject details
# issuerAltName=issuer:copy
# This really needs to be in place for it to be a proxy certificate.
proxyCertInfo=critical,language:id-ppl-anyLanguage,pathlen:3,policy:foo
####################################################################
[ tsa ]
default_tsa = tsa_config1 # the default TSA section
[ tsa_config1 ]
# These are used by the TSA reply generation only.
dir = ./demoCA # TSA root directory
serial = $dir/tsaserial # The current serial number (mandatory)
crypto_device = builtin # OpenSSL engine to use for signing
signer_cert = $dir/tsacert.pem # The TSA signing certificate
# (optional)
certs = $dir/cacert.pem # Certificate chain to include in reply
# (optional)
signer_key = $dir/private/tsakey.pem # The TSA private key (optional)
signer_digest = sha256 # Signing digest to use. (Optional)
default_policy = tsa_policy1 # Policy if request did not specify it
# (optional)
other_policies = tsa_policy2, tsa_policy3 # acceptable policies (optional)
digests = sha1, sha256, sha384, sha512 # Acceptable message digests (mandatory)
accuracy = secs:1, millisecs:500, microsecs:100 # (optional)
clock_precision_digits = 0 # number of digits after dot. (optional)
ordering = yes # Is ordering defined for timestamps?
# (optional, default: no)
tsa_name = yes # Must the TSA name be included in the reply?
# (optional, default: no)
ess_cert_id_chain = no # Must the ESS cert id chain be included?
# (optional, default: no)
ess_cert_id_alg = sha1 # algorithm to compute certificate
# identifier (optional, default: sha1)
[insta] # CMP using Insta Demo CA
# Message transfer
server = pki.certificate.fi:8700
# proxy = # set this as far as needed, e.g., http://192.168.1.1:8080
# tls_use = 0
path = pkix/
# Server authentication
recipient = "/C=FI/O=Insta Demo/CN=Insta Demo CA" # or set srvcert or issuer
ignore_keyusage = 1 # potentially needed quirk
unprotected_errors = 1 # potentially needed quirk
extracertsout = insta.extracerts.pem
# Client authentication
ref = 3078 # user identification
secret = pass:insta # can be used for both client and server side
# Generic message options
cmd = ir # default operation, can be overridden on cmd line with, e.g., kur
# Certificate enrollment
subject = "/CN=openssl-cmp-test"
newkey = insta.priv.pem
out_trusted = apps/insta.ca.crt # does not include keyUsage digitalSignature
certout = insta.cert.pem
[pbm] # Password-based protection for Insta CA
# Server and client authentication
ref = $insta::ref # 3078
secret = $insta::secret # pass:insta
[signature] # Signature-based protection for Insta CA
# Server authentication
trusted = $insta::out_trusted # apps/insta.ca.crt
# Client authentication
secret = # disable PBM
key = $insta::newkey # insta.priv.pem
cert = $insta::certout # insta.cert.pem
[ir]
cmd = ir
[cr]
cmd = cr
[kur]
# Certificate update
cmd = kur
oldcert = $insta::certout # insta.cert.pem
[rr]
# Certificate revocation
cmd = rr
oldcert = $insta::certout # insta.cert.pem
squashfs-root/etc/sysctl.conf
+64
View File
@@ -0,0 +1,64 @@
#
# /etc/sysctl.conf - Configuration file for setting system variables
# See /etc/sysctl.d/ for additional system variables.
# See sysctl.conf (5) for information.
#
#kernel.domainname = example.com
# Uncomment the following to stop low-level messages on console
#kernel.printk = 3 4 1 3
###################################################################
# Functions previously found in netbase
#
# Uncomment the next two lines to enable Spoof protection (reverse-path filter)
# Turn on Source Address Verification in all interfaces to
# prevent some spoofing attacks
#net.ipv4.conf.default.rp_filter=1
#net.ipv4.conf.all.rp_filter=1
# Uncomment the next line to enable TCP/IP SYN cookies
# See http://lwn.net/Articles/277146/
# Note: This may impact IPv6 TCP sessions too
#net.ipv4.tcp_syncookies=1
# Uncomment the next line to enable packet forwarding for IPv4
#net.ipv4.ip_forward=1
# Uncomment the next line to enable packet forwarding for IPv6
# Enabling this option disables Stateless Address Autoconfiguration
# based on Router Advertisements for this host
#net.ipv6.conf.all.forwarding=1
###################################################################
# Additional settings - these settings can improve the network
# security of the host and prevent against some network attacks
# including spoofing attacks and man in the middle attacks through
# redirection. Some network environments, however, require that these
# settings are disabled so review and enable them as needed.
#
# Do not accept ICMP redirects (prevent MITM attacks)
#net.ipv4.conf.all.accept_redirects = 0
#net.ipv4.conf.default.accept_redirects = 0
# _or_
# Accept ICMP redirects only for gateways listed in our default
# gateway list (enabled by default)
# net.ipv4.conf.all.secure_redirects = 1
#
# Do not send ICMP redirects (we are not a router)
#net.ipv4.conf.all.send_redirects = 0
#
# Log Martian Packets
#net.ipv4.conf.all.log_martians = 1
#
###################################################################
# Magic system request Key
# 0=disable, 1=enable all, >1 bitmask of sysrq functions
# See https://www.kernel.org/doc/html/latest/admin-guide/sysrq.html
# for what other values do
#kernel.sysrq=438
squashfs-root/etc/sysctl.d/10-bufferbloat.conf
+8
View File
@@ -0,0 +1,8 @@
# The Fair Queue CoDel packet scheduler is an across the board improvement to
# the default pfifo_fast qdisc. It reduces bottleneck delays, provides accurate
# RTT estimates to elephant TCP flows, and still allows shorter (sparser) flows
# like DNS, ARP, SYN, routing, etc packets priority access. For technical
# details, refer to https://www.bufferbloat.net/projects/codel/wiki/
#
# To fight bufferbloat, set it as the default qdisc in Ubuntu.
-net.core.default_qdisc = fq_codel
squashfs-root/etc/sysctl.d/10-console-messages.conf
+3
View File
@@ -0,0 +1,3 @@
# the following stops low-level messages on console
kernel.printk = 4 4 1 7
squashfs-root/etc/sysctl.d/10-ipv6-privacy.conf
+12
View File
@@ -0,0 +1,12 @@
# IPv6 Privacy Extensions (RFC 4941)
# ---
# IPv6 typically uses a device's MAC address when choosing an IPv6 address
# to use in autoconfiguration. Privacy extensions allow using a randomly
# generated IPv6 address, which increases privacy.
#
# Acceptable values:
# 0 - don’t use privacy extensions.
# 1 - generate privacy addresses
# 2 - prefer privacy addresses and use them over the normal addresses.
net.ipv6.conf.all.use_tempaddr = 2
net.ipv6.conf.default.use_tempaddr = 2
squashfs-root/etc/sysctl.d/10-kernel-hardening.conf
+25
View File
@@ -0,0 +1,25 @@
# These settings are specific to hardening the kernel itself from attack
# from userspace, rather than protecting userspace from other malicious
# userspace things.
#
#
# When an attacker is trying to exploit the local kernel, it is often
# helpful to be able to examine where in memory the kernel, modules,
# and data structures live. As such, kernel addresses should be treated
# as sensitive information.
#
# Many files and interfaces contain these addresses (e.g. /proc/kallsyms,
# /proc/modules, etc), and this setting can censor the addresses. A value
# of "0" allows all users to see the kernel addresses. A value of "1"
# limits visibility to the root user, and "2" blocks even the root user.
kernel.kptr_restrict = 1
# Access to the kernel log buffer can be especially useful for an attacker
# attempting to exploit the local kernel, as kernel addresses and detailed
# call traces are frequently found in kernel oops messages. Setting
# dmesg_restrict to "0" allows all users to view the kernel log buffer,
# and setting it to "1" restricts access to those with CAP_SYSLOG.
#
# dmesg_restrict defaults to 1 via CONFIG_SECURITY_DMESG_RESTRICT, only
# uncomment the following line to disable.
# kernel.dmesg_restrict = 0
squashfs-root/etc/sysctl.d/10-magic-sysrq.conf
+26
View File
@@ -0,0 +1,26 @@
# The magic SysRq key enables certain keyboard combinations to be
# interpreted by the kernel to help with debugging. The kernel will respond
# to these keys regardless of the current running applications.
#
# In general, the magic SysRq key is not needed for the average Ubuntu
# system, and having it enabled by default can lead to security issues on
# the console such as being able to dump memory or to kill arbitrary
# processes including the running screen lock.
#
# Here is the list of possible values:
# 0 - disable sysrq completely
# 1 - enable all functions of sysrq
# >1 - enable certain functions by adding up the following values:
# 2 - enable control of console logging level
# 4 - enable control of keyboard (SAK, unraw)
# 8 - enable debugging dumps of processes etc.
# 16 - enable sync command
# 32 - enable remount read-only
# 64 - enable signalling of processes (term, kill, oom-kill)
# 128 - allow reboot/poweroff
# 256 - allow nicing of all RT tasks
#
# For example, to enable both control of console logging level and
# debugging dumps of processes: kernel.sysrq = 10
#
kernel.sysrq = 176
squashfs-root/etc/sysctl.d/10-map-count.conf
+3
View File
@@ -0,0 +1,3 @@
# Increase the number of virtual memory areas that one process may request
# https://bugs.launchpad.net/ubuntu/+source/procps/+bug/2057792
vm.max_map_count=1048576
Loaded 100 of 15893 files, more files were not shown because too many files have changed in this diff. Show more