490f9d4a1d
Complete project rebrand for better positioning in the press freedom and digital security space. FieldWitness communicates both field deployment and evidence testimony — appropriate for the target audience of journalists, NGOs, and human rights organizations. Rename mapping: - soosef → fieldwitness (package, CLI, all imports) - soosef.stegasoo → fieldwitness.stego - soosef.verisoo → fieldwitness.attest - ~/.soosef/ → ~/.fwmetadata/ (innocuous data dir name) - SOOSEF_DATA_DIR → FIELDWITNESS_DATA_DIR - SoosefConfig → FieldWitnessConfig - SoosefError → FieldWitnessError Also includes: - License switch from MIT to GPL-3.0 - C2PA bridge module (Phase 0-2 MVP): cert.py, export.py, vendor_assertions.py - README repositioned to lead with provenance/federation, stego backgrounded - Threat model skeleton at docs/security/threat-model.md - Planning docs: docs/planning/c2pa-integration.md, docs/planning/gtm-feasibility.md Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
40 lines
1.2 KiB
Bash
Executable File
40 lines
1.2 KiB
Bash
Executable File
#!/bin/bash
|
|
# Security hardening for the live image.
|
|
set -euo pipefail
|
|
|
|
echo "=== Applying security hardening ==="
|
|
|
|
# Disable core dumps (Python doesn't zero memory — core dumps leak keys)
|
|
echo "* hard core 0" >> /etc/security/limits.conf
|
|
echo "fs.suid_dumpable = 0" >> /etc/sysctl.d/99-fieldwitness.conf
|
|
echo "kernel.core_pattern=|/bin/false" >> /etc/sysctl.d/99-fieldwitness.conf
|
|
|
|
# Disable swap (keys persist in swap pages)
|
|
systemctl mask swap.target || true
|
|
echo "vm.swappiness = 0" >> /etc/sysctl.d/99-fieldwitness.conf
|
|
|
|
# Enable UFW with deny-all + allow web UI
|
|
ufw default deny incoming
|
|
ufw default allow outgoing
|
|
ufw allow 5000/tcp comment "FieldWitness Web UI"
|
|
ufw allow 22/tcp comment "SSH"
|
|
ufw --force enable || true
|
|
|
|
# Disable unnecessary services
|
|
systemctl disable bluetooth.service 2>/dev/null || true
|
|
systemctl disable avahi-daemon.service 2>/dev/null || true
|
|
systemctl disable cups.service 2>/dev/null || true
|
|
|
|
# Enable FieldWitness service
|
|
systemctl enable soosef.service
|
|
|
|
# Auto-login to openbox (so the browser opens without login prompt)
|
|
mkdir -p /etc/lightdm/lightdm.conf.d
|
|
cat > /etc/lightdm/lightdm.conf.d/50-autologin.conf << 'EOF'
|
|
[Seat:*]
|
|
autologin-user=fieldwitness
|
|
autologin-user-timeout=0
|
|
EOF
|
|
|
|
echo "=== Hardening complete ==="
|