sudosecurity/hardline
2
0
Fork 0
Code Issues Pull requests Releases 9 Activity
9 releases 9 tags
  • v0.5.0 9a21b6a584

    Hardline 0.5.0 Stable

    Traven released this 2026-10-28 02:04:58 +00:00 | 26 commits to main since this release

    Signed self-updates, apply --all under one revert timer, accepted-risk tracking, watch alerts to Discord/Slack/ntfy/webhooks, SARIF output, eight new controls, and Ubuntu 26.04 / Debian 13 support.

    Released 2026-10-28.

    Added

    • Site: the controls page filters by search, severity, distro, profile and fix type (press / to search). Docs add an Updating section, a full table of every path Hardline writes, and signed-install steps from sudosecurity.org; the security page documents release signing and shows the public key. Landing-page numbers are now measured (median of 5 audits on 1-vCPU Ubuntu 24.04 and Rocky 9 VMs), and the binary size comes from the build.
    • hardline self-update [--check]: downloads the latest release from https://sudosecurity.org/hardline/releases/latest/, verifies the Ed25519 signature on SHA256SUMS against the release key compiled in from release.pub (OpenSSL 3 pkeyutl), checks VERSION and the bare binary against the signed sums, refuses downgrades and pending guarded changes, then replaces the binary atomically and keeps the old one at /var/lib/hardline/hardline.previous. The release workflow publishes an unsigned draft; the Ed25519 key stays root-only on the release host, which signs SHA256SUMS before the release is published (see CONTRIBUTING.md).
    • Eight new baseline controls: ssh-login-grace-time (LoginGraceTime 1-60, phase 1), aide-installed (installs AIDE, aide-common on Debian/Ubuntu so aideinit and the daily timer come with it) and aide-database (manual: build the baseline from a trusted state) in phase 4, docker-no-tcp-socket (no tcp:// Docker API without tlsverify, from daemon.json or -H flags; manual) in phase 6, and in phase 7 kernel-unprivileged-bpf-disabled (sets 2, which root can undo without a reboot), kernel-yama-ptrace-scope (sets 1), kernel-lockdown and kernel-module-sig-enforce (report-only; need a reboot).
    • hardline accept <id> --reason "...", hardline accept (list) and hardline unaccept <id>. Accepted findings keep their real status but are shown as accepted risk with who and why, are left out of the grade, the audit exit code and watch regressions, are skipped by apply, and are marked suppressed in SARIF. Stored in root-owned /etc/hardline/accepted.toml. The JSON report gains results[].accepted and score.accepted.
    • hardline watch notify set|test|remove posts watch regressions to Discord, Slack, ntfy or a generic JSON webhook. The URL is read from stdin, must be https without credentials, is saved only after a test alert succeeds, and lives in root-only /etc/hardline/notify.toml (mode 600, refused otherwise). It reaches curl through --config - and never appears in argv, logs or errors. A failed post is logged and doesn't change the run's exit code.
    • hardline apply --all previews every phase; apply --all --commit applies them in one run. Phases 3–8 commit one by one (each still has its own rollback --phase N), then SSH (1) and the firewall (2) go last under one revert timer, one boot guard and one hardline confirm from a new login. If you can't log back in, both revert together, newest first. If a later guarded phase fails, the earlier one is reverted too rather than left without a timer. pending.json gains an optional chain list; a single-phase change keeps the old shape.
    • Ubuntu 26.04 LTS and Debian 13 (trixie) are supported with the baseline profile. Both passed the VM lockout scenarios (timer revert, same-session confirm refused, new-session confirm, reboot before confirm) and every phase with a reboot. Ubuntu 26.04 ships sudo-rs and Rust coreutils by default; Hardline works with both.
    • hardline audit --sarif prints SARIF 2.1.0 for GitHub code scanning and other dashboards. Failing and warning controls become results with security-severity, STIG/CCI tags and a stable per-host fingerprint; a check that couldn't run becomes a tool notification and marks the run unsuccessful. Exit codes are unchanged.
    • Hardline pages get per-page share images (Open Graph and X cards), Twitter/X titles, and schema.org data (SoftwareApplication on /hardline/, breadcrumbs elsewhere); site/og.py renders the images.
    • New /hardline/architecture/ page, and docs for the JSON report fields, SARIF upload, watch alerting, Ansible, cloud-init and grade gates.

    Changed

    • Findings and hardline explain link to https://sudosecurity.org/hardline/controls/, the new controls reference. Links from older versions to /hardline/#id still land on the right entry.
    • site/build.py now builds every Hardline page on sudosecurity.org (overview, docs, controls, security, sample report, changelog, about) into site/pages/, and site/publish.py publishes them to Ghost.

    Install

    Prebuilt binaries are published for the latest release only. Use the latest release, or build this tag from source:

    git clone --branch v0.5.0 https://git.sudosecurity.org/sudosecurity/hardline.git && cd hardline
cargo build --release --locked

    Full changelog: https://git.sudosecurity.org/sudosecurity/hardline/compare/v0.4.1...v0.5.0

    Downloads