Dear Kicksecure Development Team,
I would like to suggest some enhancements to the GRUB Live environment. Specifically, it would be beneficial to include additional features or options that could improve user experience and functionality. Here are two ideas to include with the grub-live package:
-
Grub live entry for offline mode: another grub live entry for booting into Live mode USER with all networking disabled
-
Grub live entry that boots with Tor only firewall rules: another grub live entry for booting into Live mode USER with Tor only firewall with tor transparent proxy for users that are on lower RAM systems that don’t want to install whonix with the installer in usability misc but already have tb-launcher installed. Tor daemon already comes installed with Kicksecure so additionally maybe load some torsocks wrappers for certain commands like curl, wget, git, whois, etc. if possible.
Here are some drafts that I havent tried yet but will put them here for a starting point, reference, and ideas.
offline mode
/etc/grub.d/40_offline_mode
# GRUB Live entry to disable networking (offline mode)
menuentry "LIVE mode USER (Offline Mode)" {
# Run the disable networking script that blacklists all wireless drivers and firewall to block all traffic
/usr/local/bin/disable_networking
set root=(hd0,1) # Adjust this to your root partition
# mask network target
linux /vmlinuz-linux root=/dev/sda1 quiet splash systemd.mask=network.target
initrd /initramfs-linux.img
}
/usr/local/bin/disable_networking
#!/bin/bash
### Grub disable networking script called by
## Blacklist all wifi drivers
## Blacklist bluetooth driver (commented out)
# Create blacklist file
touch /etc/modprobe.d/disable_networking.conf 2>/dev/null
# Define the blacklist file path
BLACKLIST_FILE="/etc/modprobe.d/disable_networking.conf"
# Create or clear the blacklist file
echo "# Custom blacklist for wireless drivers" | tee $BLACKLIST_FILE > /dev/null
# Get the list of wireless drivers
WIRELESS_DRIVERS=$(ls /lib/modules/$(uname -r)/kernel/drivers/net/wireless/)
# Check if there are any wireless drivers
if [ -z "$WIRELESS_DRIVERS" ]; then
echo "No wireless drivers found in /lib/modules/$(uname -r)/kernel/drivers/net/wireless/"
else
# Loop through each driver and add it to the blacklist
for DRIVER in $WIRELESS_DRIVERS; do
DRIVER_NAME=$(basename "$DRIVER" | sed 's/\.[^.]*$//') # Remove file extension
echo "blacklist $DRIVER_NAME" | tee -a $BLACKLIST_FILE > /dev/null
echo "Blacklisted driver: $DRIVER_NAME"
# Remove the driver if it is currently loaded
if lsmod | grep -q "$DRIVER_NAME"; then
echo "Removing loaded driver: $DRIVER_NAME"
modprobe -r "$DRIVER_NAME"
fi
done
fi
## Blacklist bluetooth
# List of Bluetooth drivers to blacklist
#BT_DRIVERS=(
# "btusb"
# "bluetooth"
# "btintel"
#)
#
# Loop through the drivers and add them to the blacklist
#for DRIVER in "${BT_DRIVERS[@]}"; do
# echo "blacklist $DRIVER" >> "BLACKLIST_FILE"
# modprobe -r "$DRIVER"
#done
### Firewall
# Set up nftables to disable all incoming, forwarding, and outgoing traffic
echo "Setting up nftables to disable all network traffic..."
# Flush existing rules
nft flush ruleset
# Create a new ruleset
nft add table inet filter
nft add chain inet filter input { type filter hook input priority 0; }
nft add chain inet filter forward { type filter hook forward priority 0; }
nft add chain inet filter output { type filter hook output priority 0; }
# Set default policies to drop all traffic
nft add rule inet filter input drop
nft add rule inet filter forward drop
nft add rule inet filter output drop
echo -e " All wireless drivers have been blacklisted in $BLACKLIST_FILE.\n All network traffic has been disabled.\n Offline mode enabled"
Tor only
/etc/grub.d/40_tor_only_firewall
menuentry "LIVE mode USER (Tor Only)" {
# Run the Tor firewall script
/usr/local/bin/Tor_only_firewall
# Boot into the default kernel
linux /vmlinuz-<your-kernel-version> root=/dev/sda1 ro
initrd /initrd.img-<your-kernel-version>
}
/usr/local/bin/Tor_only_firewall
#!/bin/bash
### Tor only firewall for GRUB Live (Tor Only)
# Flush existing rules
nft flush ruleset
# Create a new ruleset
nft add table inet filter
nft add chain inet filter input { type filter hook input priority 0; }
nft add chain inet filter forward { type filter hook forward priority 0; }
nft add chain inet filter output { type filter hook output priority 0; }
# Allow loopback traffic
nft add rule inet filter input iif "lo" accept
nft add rule inet filter output oif "lo" accept
# Allow established and related connections
nft add rule inet filter input ct state established,related accept
nft add rule inet filter output ct state established,related accept
# Allow Tor traffic (default Tor port is 9050)
nft add rule inet filter input tcp dport 9050 accept
nft add rule inet filter output tcp sport 9050 accept
# Allow DNS traffic (UDP port 53)
nft add rule inet filter input udp dport 53 accept
nft add rule inet filter output udp sport 53 accept
# Drop all other traffic
nft add rule inet filter input drop
nft add rule inet filter forward drop
nft add rule inet filter output drop
echo "Tor only firewall rules applied."