Arch Linux

ShadowOfRome

Member

Registered: Yesterday

Posts: 3

Black Velvet - A toolset to upgrade and assess your security

Long time reader, but new to the forums. Please forgive in advance any breach of etiquette.

If anyone's interested: Black Velvet is a toolset to quickly upgrade and assess your Linux security.

While it can harden Linux and reduce attack surface, it only applies your choices. The program is user-friendly and won't implement anything without your approval. It also applies the settings you've selected, not some arbitrary ones that might not fit your use case.

Overview of features          => Any feature can be skipped, so feel free to use only what you need
   
    Kernel:
       
        1/2 Manage Boot parameters (add/remove/update)
            If running Grub, current parameters will show with different color schemes and the bootloader can be directly updated
            (Next weeks) Support for Systemd-boot and Syslinux bootloaders will be added
       
        2/2 Manage Sysctls (add/remove/update)
            Your current security Sysctls will show with different color schemes depending on whether they are set to secure values
       
        => Includes internal databases of Boot parameters and Sysctls for easy reference, with links to https://docs.kernel.org/
       
       
    Modules:
       
        1/3 Select which modules to disable among suggested presets of Network protocols, Filesystems, and Drivers
       
        2/3 Disable any Custom modules with known security issues, or that are unnecessary on the host (your picks)
       
        3/3 Re-enable any modules that are currently disabled
       
        => Includes search functions and modules descriptions through modinfo, along with current statuses (enabled | disabled)
       
       
    Core dumps:
        Disable Core dumps that can leak sensitive data (disables through Sysctls, ulimit, also disables Systemd dumps)
       
       
    Linux Audit:
        Set up the Linux Audit Framework to monitor files, directories, and activities
        You can select among preset rules or use your own
       
       
    AppArmor:
        Set up AppArmor and enable it at boot
        (Next weeks) Support for AppArmor options toggle and statistics
        (Next weeks) Release of an AppArmor profiles manager, to speed up the process of testing AppArmor profiles
       
       
    Aide:
        Set up the Aide local intrusion detection system to provide snapshots of what was added, changed or removed on the host
        You can select among tried preset rules or use your own
       
       
    Logwatch:
        Set up logwatch to get aggregated logs reports and save time
        You can also set up predefined jobs which will email logwatch reports at selected intervals
       
       
    Audit Accounts:
        Check users with sudo privileges in administrative groups, unlocked non-human accounts (security issue),
        and accounts expecting a password to be set at the first login (security hole)
       
       
    Secure Boot:
        Search for unknown Sha256 hashes in the MOK (Machine Owner Key) list - investigate in-depth as needed
       
       
    Insecure Packages:       
        Search for insecure packages installed on the system
        You have the option of stopping any process found, and removing the package
        Vulnerabilities are summarized; secure software alternatives are shown on-the-fly and in the final report
       
        => Includes an internal database of 26 packages with known security issues and/or considered high risk
       
       
    Report:
        A clear report will show which features were run, which were skipped during the session
        along with Major events and actions performed => Successes, Warnings, Errors

I tested it intensively on Arch.

Important note: this software was not made with AI. Although you can see some Gen AI backgrounds in the screenshots, it was entirely coded by hand (and I intend to keep it that way).

Black Velvet can help you quickly improve and audit your Linux security. It was designed with that goal in mind, so you can choose the options that best suit your system and use case.
   
Thank you for your time. I'll be glad if it helps.
   
Black Velvet is hosted at codeberg.org => https://codeberg.org/black-velvet/black-velvet
Released under LGPLv3

Lone_Wolf

Administrator

From: Netherlands, Europe

Registered: 2005-10-04

Posts: 15,386

Re: Black Velvet - A toolset to upgrade and assess your security

interesting, what functionality of it works without root rights ?

BV_1_boot_parameters_3.png and and Black_Velvet_4.png backgrounds look like it might be persons with recognizable faces .
Are you sure those are not of real persons ?

---

Disliking systemd intensely, but not satisfied with alternatives so focusing on taming systemd.

clean chroot building not flexible enough ?
Try clean chroot manager by graysky

hollytropical

Member

Registered: Yesterday

Posts: 4

Re: Black Velvet - A toolset to upgrade and assess your security

       
        2/2 Manage Sysctls (add/remove/update)
            Your current security Sysctls will show with different color schemes depending on whether they are set to secure values
       
        => Includes internal databases of Boot parameters and Sysctls for easy reference, with links to https://docs.kernel.org/

Nice tool. If I have a system with a kernel I built myself with 'hard-coded' options instead of sysctls, then does your tool take it in account? By 'hard-coded', I mean for example: CONFIG_BPF_SYSCALL=n

---

minimalist, following Mental Outlaw and Even Becker

ShadowOfRome

Member

Registered: Yesterday

Posts: 3

Re: Black Velvet - A toolset to upgrade and assess your security

interesting, what functionality of it works without root rights ?

The "Audit Accounts" functionality works without usage of sudo, so does the "Validation" one which checks your software environment before the run itself.
And the "Search for Insecure packages" one, unless you find something that you want to stop and remove.
For most of the other features, I'm afraid sudo is needed at some point when you approve an operation.
   
It's rather difficult to deal with Boot parameters, modules, the Audit framework, etc without resorting to sudo at some point.
I don't know of any workarounds that are not config-specific; my bad if there are any and I was too hasty.
I also sincerely admit that I wouldn't trust a script like Black Velvet, without testing it first in a disposable Virtual Machine (with rather strong isolation) and reading its code.

BV_1_boot_parameters_3.png and and Black_Velvet_4.png backgrounds look like it might be persons with recognizable faces .
Are you sure those are not of real persons ?

I can't be sure of that, sorry. These were preexisting backgrounds which I downloaded from the web (I didn't create them). But they can be easily replaced with more static images to be sure. You have a point, and I'll try do that as soon as possible.

ShadowOfRome

Member

Registered: Yesterday

Posts: 3

Re: Black Velvet - A toolset to upgrade and assess your security

If I have a system with a kernel I built myself with 'hard-coded' options instead of sysctls, then does your tool take it in account? By 'hard-coded', I mean for example: CONFIG_BPF_SYSCALL=n

That wasn't tested, but sysctl reads and writes through the /proc/sys/ virtual filesystem. If you have eBPF disabled, it should still work.
You obviously won't have the ability to set sysctls related to eBPF, but they no longer matter:
    net.core.bpf_jit_enable
    net.core.bpf_jit_harden
    net.core.bpf_jit_kallsyms
    kernel.unprivileged_bpf_disabled

I see that completely disablng eBPF can be a wise precaution vs some rootkit exploits. Nice one.