add some hardening

dotfiles/grub/etc/default/grub

@@ -6,7 +6,7 @@ GRUB_DEFAULT=0
 #GRUB_HIDDEN_TIMEOUT_QUIET=false
 GRUB_TIMEOUT=5
 GRUB_DISTRIBUTOR="Void"
-GRUB_CMDLINE_LINUX_DEFAULT="loglevel=2 apparmor=1 security=apparmor"
+GRUB_CMDLINE_LINUX_DEFAULT="quiet loglevel=0 apparmor=1 security=apparmor slab_nomerge init_on_alloc=1 init_on_free=1 page_alloc.shuffle=1 pti=on randomize_kstack_offset=on vsyscall=on debugfs=off ipv6.disable=1 random.trust_cpu=off"
 # Uncomment to use basic console
 #GRUB_TERMINAL_INPUT="console"
 # Uncomment to disable graphical terminal

dotfiles/install-machine-id.sh

@@ -0,0 +1,7 @@
+#!/bin/sh
+
+if [ -e /var/lib/dbus/machine-id ]; then
+  sudo rm /var/lib/dbus/machine-id
+fi
+
+install_dotfiles "/" "$DOTFILES_DIR" "machine-id"

dotfiles/install.sh

@@ -10,6 +10,7 @@ INSTALLING DOTFILES:
 . "$DOTFILES_DIR/install-ghostty.sh"
 . "$DOTFILES_DIR/install-helix.sh"
 . "$DOTFILES_DIR/install-iwd.sh"
+. "$DOTFILES_DIR/install-machine-id.sh"
 . "$DOTFILES_DIR/install-mako.sh"
 . "$DOTFILES_DIR/install-mango.sh"
 . "$DOTFILES_DIR/install-scooter.sh"

dotfiles/machine-id/var/lib/dbus/machine-id

@@ -0,0 +1 @@
+b08dfa6083e7567a1921a715000001fb