maemachinebroke/hakurei
1
0
Fork 0
forked from rosa/hakurei
Code Pull Requests Activity
289 Commits 7 Branches 12 Tags
141f2e3685f2518731f6b1c89e29622338c6a806
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
cat 141f2e3685 workflows: cache apt packages 
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
 2024-12-18 23:05:28 +09:00
cat 73aa285e8f workflows: upload nixos test output 
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
 2024-12-18 20:32:40 +09:00
cat 6e87fc02dd workflows: build and upload test distribution 
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
 2024-12-18 20:28:35 +09:00
cat 52f21a19f3 cmd/fshim: switch to setup pipe 
The socket-based approach is no longer necessary as fsu allows extra files and sudo compatibility is no longer relevant.

Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
 2024-12-18 19:39:25 +09:00
cat 7be53a2438 cmd/fshim: switch to generic setup func 
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
 2024-12-18 17:20:31 +09:00
cat 7f29b37a32 proc: setup payload send 
Generic setup payload encoder adapted from fshim.

Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
 2024-12-18 17:20:01 +09:00
cat f69e8e753e cmd/finit: switch to generic receive func 
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
 2024-12-18 16:49:19 +09:00
cat ef8fd37e9d proc: setup payload receive 
Generic implementation of setup payload receiver adapted from finit.

Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
 2024-12-18 16:48:41 +09:00
cat 2f676c9d6e fst: rename from fipc 
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
 2024-12-18 15:50:46 +09:00
cat bbace8f84b nix: increase cpu count 
This improves performance, especially when kvm is inaccessible.

Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
 2024-12-18 15:32:52 +09:00
cat 2efedf56c0 nix: collect fortify ps output 
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
 2024-12-18 13:48:39 +09:00
cat b752ec4468 fipc: export config struct 
Also store full config as part of state.

Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
 2024-12-18 13:45:55 +09:00
cat 5d00805a7c nix: check acl rollback 
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
 2024-12-18 12:49:32 +09:00
cat 7b6052a473 nix: run Go tests in nixos 
Nix build environment does not support ACLs in any filesystem. This allows acl tests to run.

Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
 2024-12-17 21:16:55 +09:00
cat 38653c6ab5 release: 0.2.3 
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
 2024-12-17 14:06:17 +09:00
cat b5cbbeab90 dist: generate distribution tarball 
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
 2024-12-17 14:02:54 +09:00
cat c3ba0c3cce nix: rename nixos test 
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
 2024-12-17 13:02:12 +09:00
cat b453f70ca2 cmd/fsu: check uid range before syscall 
This limits potential exploits to the fortify uid range.

Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
 2024-12-17 13:01:36 +09:00
cat c2b178e626 xcb: refactor and clean up 
No clean way to write Go tests for this package. Will rely on NixOS tests for now.

Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
 2024-12-17 12:46:36 +09:00
cat aeda40fc92 nix: test x11 permissive defaults 
Also invoke glinfo/wayland-info as part of tests.

Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
 2024-12-17 12:40:29 +09:00
cat 65dc39956f workflows: set action names 
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
 2024-12-17 11:12:39 +09:00
cat 35505c8a26 workflows: invoke nix flake checks 
Integration tests are implemented as nix flake checks.

Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
 2024-12-17 10:49:43 +09:00
cat 3f993021f8 nix: permissive defaults nixos test 
Adapted from nixos sway integration tests.

Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
 2024-12-16 22:56:10 +09:00
cat 4d3bd5338f nix: implement flake checks 
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
 2024-12-16 20:54:28 +09:00
cat 138666d753 nix: skip acl test 
The nix build environment does not support ACLs.

Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
 2024-12-16 19:29:01 +09:00
cat f4628e181b acl: create test file in tmpdir 
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
 2024-12-16 18:58:09 +09:00
cat c8a90666c5 acl: refactor and clean up 
Move all C code to c.go, switch to pkg-config, set up finalizer for acl.

Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
 2024-12-16 18:27:19 +09:00
cat ee41b37606 acl: add tests 
These tests test UpdatePerm correctness by parsing getfacl output.

Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
 2024-12-16 16:00:31 +09:00
cat e3f1d7ba60 release: 0.2.2 
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
 2024-12-07 21:47:22 +09:00
cat 39e3ac3ccd nix: require /etc/userdb nix-daemon 
There seems to be some kind of credential caching in nix-daemon.

Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
 2024-12-07 21:07:57 +09:00
cat 33c95b80ca cmd/fuserdb: rename home directories 
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
 2024-12-07 20:23:46 +09:00
cat 40cc8a68d1 nix: rename home directories 
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
 2024-12-07 20:15:37 +09:00
cat f773c92411 system: prevent duplicate Wayland op 
Wayland is implemented as an Op to enforce dependency and cleanup, its implementation does not allow multiple instances on a single sys object, nor would doing that make any sense.

Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
 2024-12-07 19:45:37 +09:00
cat 16ab734fcd update README document 
A lot of this information is no longer true since fsu. Remove them for now and write up proper documentation later.

Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
 2024-12-06 17:04:36 +09:00
cat cc816a1aaa proc: cleaner extra files 
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
 2024-12-06 16:05:04 +09:00
cat b3ef53b193 app: integrate security-context-v1 
Should be able to get rid of XDG_RUNTIME_DIR share after this.

Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
 2024-12-06 04:25:33 +09:00
cat 8d0573405a helper/bwrap: implement sync fd 
This is required by wayland security-context-v1.

Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
 2024-12-06 04:21:37 +09:00
cat 38e92edb8e system/wayland: integrate security-context-v1 
Had to pass the sync fd through sys. The rest are just part of a standard Op.

Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
 2024-12-06 04:20:15 +09:00
cat 2d606b1f4b wl: implement security-context-v1 
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
 2024-12-06 04:15:13 +09:00
cat 1b5b089c78 fortify: rename --dbus-id to --id 
This value is no longer specific to D-Bus defaults.

Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
 2024-12-06 03:26:09 +09:00
cat 6b8ddca7b4 nix: track nixos stable 24.11 
Reduce rebuilds during development on my system.

Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
 2024-12-06 00:44:04 +09:00
cat 95668ac998 nix: expose no_new_session in module 
Useful for shells and terminal programs like chat clients.

Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
 2024-11-28 00:19:06 +09:00
cat b291f0b710 app: add nixos-based config test case 
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
 2024-11-21 12:13:21 +09:00
cat 3a20b149ce update README document 
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
 2024-11-21 11:22:34 +09:00
cat 30b8bce90a fortify: zsh completion 
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
 2024-11-20 01:25:19 +09:00
cat de0d78daae release: 0.2.1 
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
 2024-11-19 21:03:50 +09:00
cat 6bf33ce507 fortify: use resolved username 
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
 2024-11-19 21:03:09 +09:00
cat 9faf3b3596 app: validate username 
This value is used for passwd generation. Bad input can cause very confusing issues. This is not a security issue, however validation will improve user experience.

Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
 2024-11-19 21:01:41 +09:00
cat d99c8b1fb4 release: 0.2.0 
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
 2024-11-19 18:15:09 +09:00
cat 6e4870775f update README document 
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
 2024-11-19 18:14:06 +09:00
cat 0a546885e3 nix: update options doc 
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
 2024-11-19 18:12:35 +09:00
cat 653d69da0a nix: module descriptions 
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
 2024-11-19 18:10:57 +09:00
cat f8256137ae nix: separate module options from implementation 
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
 2024-11-19 17:08:22 +09:00
cat 54b47b0315 nix: copy pixmaps directory to share package 
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
 2024-11-18 14:46:08 +09:00
cat ae2628e57a cmd/fshim/ipc: install signal handler on shim start 
Getting killed at this point will result in inconsistent state.

Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
 2024-11-18 13:33:46 +09:00
cat c026a4b5dc fortify: permissive defaults resolve home directory from os 
When starting with the permissive defaults "run" command, attempt to resolve home directory from os by default and fall back to /var/empty.

Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
 2024-11-18 13:01:07 +09:00
cat 748a0ae2c8 nix: wrap program from libexec 
This avoids renaming the fortify binary.

Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
 2024-11-18 12:58:47 +09:00
cat 8f3f0c7bbf nix: integrate dynamic users 
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
 2024-11-18 02:49:48 +09:00
cat 05b7dbf066 app: alternative inner home path 
Support binding home to an alternative path in the mount namespace.

Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
 2024-11-18 00:18:21 +09:00
cat 866270ff05 fmsg: add to wg prior to enqueue 
Adding after channel write is racy.

Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
 2024-11-17 23:50:02 +09:00
cat c1fad649e8 app/start: check for cleanup and abort condition 
Dirty fix. Will rewrite after fsu integration complete.

Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
 2024-11-17 23:41:52 +09:00
cat b5f01ef20b app: append # for ChangeHosts message with numerical uid 
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
 2024-11-17 23:40:37 +09:00
cat 2e23cef7bb cmd/fuserdb: generate group entries 
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
 2024-11-17 23:31:06 +09:00
cat 6a6d30af1f cmd/fuserdb: systemd userdb drop-in entries generator 
This provides user records via nss-systemd. Static drop-in entries are generated to reduce complexity and attack surface.

Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
 2024-11-17 02:16:02 +09:00
cat df33123bd7 app: integrate fsu 
This removes the dependency on external user switchers like sudo/machinectl and decouples fortify user ids from the passwd database.

Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
 2024-11-16 21:19:45 +09:00
cat 1a09b55bd4 nix: remove portal paths from default 
Despite presenting itself as a generic desktop integration interface, xdg-desktop portal is highly flatpak-centric and only supports flatpak and snap in practice. It is a significant attack surface to begin with as it is a privileged process which accepts input from unprivileged processes, and the lack of support for anything other than fortify also introduces various information leaks when exposed to fortify as it treats fortified programs as unsandboxed, privileged programs in many cases.

Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
 2024-11-10 22:24:17 +09:00
cat 9a13b311ac app/config: rename map_real_uid from use_real_uid 
This option only changes mapped uid in the user namespace.

Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
 2024-11-09 12:01:34 +09:00
cat 45fead18c3 cmd/fshim: set no_new_privs flag 
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
 2024-11-09 11:50:56 +09:00
cat 431aa32291 nix: remove absolute Exec paths 
Absolute paths set for Exec causes the program to be launched as the privileged user.

Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
 2024-11-08 02:05:47 +09:00
cat 3962705126 nix: keep fshim and finit names 
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
 2024-11-06 14:59:28 +09:00
cat ad80be721b nix: improve start script 
Zsh store path in shebang. Replace writeShellScript with writeScript since runtimeShell is not overridable.

Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
 2024-11-06 14:09:41 +09:00
cat f831948bca release: 0.1.0 
This release significantly changes the command line interface, and updates the NixOS module to finally produce meaningful sandbox configuration.

Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
 2024-11-06 04:37:43 +09:00
cat 2e31b3d3a1 update README document 
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
 2024-11-06 04:35:52 +09:00
cat 4d90e73366 nix: generate strict sandbox configuration 
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
 2024-11-06 04:25:15 +09:00
cat 3dfc1fcd56 app: support full /dev access 
Also moved /dev/fortify to /fortify since it is impossible to create new directories in /dev from the init namespace and bind mounting its contents has undesirable side effects.

Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
 2024-11-06 03:49:39 +09:00
cat 89bafd0c22 fortify: root check before command handling 
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
 2024-11-05 12:57:03 +09:00
cat 861bb1274f fortify: override default usage function 
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
 2024-11-05 00:12:31 +09:00
cat 714818c8aa fortify: implement cleaner argument structure 
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
 2024-11-05 00:07:36 +09:00
cat 69cc64ef56 linux: provide access to stdout 
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
 2024-11-04 22:55:46 +09:00
cat fc25ac2523 app: separate auto etc from permissive defaults 
Populating /etc with symlinks is quite useful even outside the permissive defaults usage pattern.

Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
 2024-11-04 22:18:05 +09:00
cat d909b1190a app/config: UseRealUID as true in template 
The template is based on a Chromium setup, which this workaround was created for.

Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
 2024-11-04 19:45:31 +09:00
cat cfd05b10f1 release: 0.0.11 
This will be the final release before major command line interface changes. This version is tagged as it contains many fixes that still impacts the permissive defaults usage pattern.

Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
 2024-11-04 13:46:47 +09:00
cat aa067436a7 workflows: build all packages with full ldflags 
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
 2024-11-04 13:43:57 +09:00
cat d7df24c999 fmsg: drop messages when msgbuf is full during withhold 
Logging functions are not expected to block. This change fixes multiple hangs where more than 64 messages are produced during withhold.

Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
 2024-11-04 12:56:19 +09:00
cat 88abcbe0b2 cmd/fsu: remove import of internal package 
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
 2024-11-04 12:32:14 +09:00
cat af15b1c048 app: support mapping target uid as privileged uid in sandbox 
Chromium's D-Bus client implementation refuses to work when its getuid call returns a different value than what the D-Bus server is running as. The reason behind this is not fully understood, but this workaround is implemented to support chromium and electron apps. This is not used by default since it has many side effects that break many other programs, like SSH on NixOS.

Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
 2024-11-04 03:15:39 +09:00
cat 7962681f4a app: format mapped uid instead of real uid 
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
 2024-11-04 00:49:32 +09:00
cat bfcce3ff75 system/dbus: buffer xdg-dbus-proxy messages 
Pointing xdg-dbus-proxy to stdout/stderr makes a huge mess. This change enables app to neatly print out prefixed xdg-dbus-proxy messages after output is resumed.

Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
 2024-11-03 03:07:02 +09:00
cat 8cd3651bb6 cmd/fshim/ipc: friendly setup timeout message 
This message eventually gets returned by the app's Start method, so they should be wrapped to provide a friendly message.

Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
 2024-11-03 02:03:30 +09:00
cat 422d8e00d5 fortify: replace direct syscall with prctl wrapper 
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
 2024-11-02 17:00:25 +09:00
cat 584732f80a cmd: shim and init into separate binaries 
This change also fixes a deadlock when shim fails to connect and complete the setup.

Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
 2024-11-02 03:13:57 +09:00
cat 4b7b899bb3 add package doc comments 
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
 2024-10-28 20:57:59 +09:00
cat 563c39c2d9 release: 0.0.10 
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
 2024-10-28 20:38:10 +09:00
cat aa1f96eeeb fsu: check parent executable path 
Only allow main program to launch fsu. This change and further checks in the main program reduces attack surface.

Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
 2024-10-28 18:52:23 +09:00
cat 431dc095e5 app/start: skip cleanup if shim is nil 
Shim is created before any system operation happens.

Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
 2024-10-28 14:21:15 +09:00
cat 60e91b9b0f shim: expose checkPid in constructor 
This will be supported soon when launching via fsu.

Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
 2024-10-28 00:02:55 +09:00
cat d9cb2a9f2b fsu: implement simple setuid user switcher 
Contains path to fortify, set at compile time, authenticates based on a simple uid range assignment file which also acts as the allow list.

Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
 2024-10-28 00:02:34 +09:00
cat 09feda3783 fortify: exit if seal returns error 
Wait should not be called on an unsealed App.

Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
 2024-10-27 23:18:16 +09:00
cat 51e84ba8a5 system/dbus: compare sealed value by string 
Stringer method of dbus.Proxy returns a string representation of its args stream when sealed.

Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
 2024-10-27 12:09:34 +09:00
cat 7df9d8d01d system: move sd_booted implementation to os abstraction 
This implements lazy loading of the systemd marker (they are not accessed in init and shim) and ensures consistent behaviour when running with a stub.

Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
 2024-10-27 12:09:34 +09:00