Skip to content

feat: reduce attack surface due to packages #2006

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
samrose wants to merge 3 commits into
base: develop
Choose a base branch
from
Draft

feat: reduce attack surface due to packages #2006

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
ef3a10c
feat: reduce attack surface
samrose Jan 19, 2026
7a3b516
fix: gcc-14-base is just shared files used by runtime libs, not compi…
samrose Jan 19, 2026
3cdcbe4
fix: bypass need for add-apt-repository since it's gone by this point
samrose Jan 30, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
37 changes: 37 additions & 0 deletions ansible/tasks/clean-build-dependencies.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,3 +19,40 @@
- patch
- python2
state: 'absent'

# Security hardening: remove packages that increase attack surface
# - Compiler toolchain enables local exploit compilation
# - Dev packages provide headers for building exploits
# - salt-minion is a remote management agent (large attack surface)
# - sshpass stores credentials in plaintext
- name: Remove high-security-risk packages
ansible.builtin.apt:
autoremove: true
pkg:
# Compiler toolchain (gcc-14-base kept - libgcc-s1 runtime depends on it)
- binutils
- binutils-aarch64-linux-gnu
- binutils-common
# Dev/header packages
- libc6-dev
- libcrypt-dev
- libevent-dev
- libpcre3-dev
- libssl-dev
- libsystemd-dev
- linux-headers-aws
- linux-libc-dev
- pkg-config
- pkgconf
- pkgconf-bin
- rpcsvc-proto
- systemd-dev
- zlib1g-dev
# Remote management (if not used)
- salt-minion
- salt-common
# Credential handling
- sshpass
# Build tool leftovers
- ansible-core
state: 'absent'
4 changes: 3 additions & 1 deletion scripts/90-cleanup-qemu.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -38,7 +38,9 @@ elif [ -n "$(command -v apt-get)" ]; then
ansible \
snapd

add-apt-repository --yes --remove ppa:ansible/ansible
# Remove ansible PPA directly (software-properties-common may not be installed)
rm -f /etc/apt/sources.list.d/ansible-ubuntu-ansible-*.list \
/etc/apt/sources.list.d/ansible-ubuntu-ansible-*.sources 2>/dev/null || true

source /etc/os-release

Expand Down
4 changes: 3 additions & 1 deletion scripts/90-cleanup.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -36,7 +36,9 @@ elif [ -n "$(command -v apt-get)" ]; then
libgcc-9-dev \
ansible

add-apt-repository --yes --remove ppa:ansible/ansible
# Remove ansible PPA directly (software-properties-common may not be installed)
rm -f /etc/apt/sources.list.d/ansible-ubuntu-ansible-*.list \
/etc/apt/sources.list.d/ansible-ubuntu-ansible-*.sources 2>/dev/null || true

source /etc/os-release

Expand Down
Loading