maemachinebroke/hakurei
1
0
Fork 0
forked from security/hakurei
Code Pull Requests Activity
797 Commits 1 Branch 12 Tags
625632c59391d73d32389e877179d3e023e224f2
Commit Graph

89 Commits

Author SHA1 Message Date
Ophestra
625632c593 nix: update flake lock 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-07-26 18:57:54 +09:00
Ophestra
6ba19a7ba5 release: 0.1.1 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-07-09 05:42:31 +09:00
Ophestra
e6967b8bbb release: 0.1.0 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-07-03 03:42:58 +09:00
Ophestra
d2f9a9b83b treewide: migrate to hakurei.app 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-07-03 03:30:39 +09:00
Ophestra
a1d98823f8 hakurei: move container toplevel 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-07-02 21:23:55 +09:00
Ophestra
0e957cc9c1 release: 0.0.2 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-06-25 21:11:11 +09:00
Ophestra
aa454b158f cmd/planterette: remove hsu special case 
Remove special case and invoke hakurei out of process.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-06-25 20:50:24 +09:00
Ophestra
b380bb248c release: 0.0.1 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-06-25 05:05:06 +09:00
Ophestra
87e008d56d treewide: rename to hakurei 
Fortify makes little sense for a container tool.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-06-25 04:57:41 +09:00
Ophestra
3992073212 dist: move comp to dist 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-06-18 17:01:16 +09:00
Ophestra
9a7c81a44e nix: go generate in src derivation 
This saves the generated files in the nix store and exposes them for use by external tools.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-06-07 03:10:36 +09:00
Ophestra
6c1205106d release: 0.4.1 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-05-26 02:55:19 +09:00
Ophestra
d6cf736abf release: 0.4.0 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-04-13 11:10:45 +09:00
Ophestra
12be7bc78e release: 0.3.3 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-04-01 01:42:10 +09:00
Ophestra
48f634d046 release: 0.3.2 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-03-30 23:05:57 +09:00
Ophestra
2a4e2724a3 release: 0.3.1 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-03-26 07:48:50 +09:00
Ophestra
92852d8235 release: 0.3.0 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-03-26 02:18:59 +09:00
Ophestra
b39f3aeb59 helper: remove bubblewrap wrapper 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-03-25 05:35:02 +09:00
Ophestra
0eb1bc6301 test/sandbox: verify outcome via mountinfo 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-03-24 01:42:38 +09:00
Ophestra
0a4e633db2 nix: filter test from source 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-03-23 22:20:19 +09:00
Ophestra
3385538142 nix: clean up flake outputs 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-03-17 12:26:19 +09:00
Ophestra
4bb5d9780f ldd: run in native sandbox 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-03-14 17:55:55 +09:00
Ophestra
9b1a60b5c9 sandbox: native container tooling 
This should eventually replace bwrap.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-03-13 21:36:26 +09:00
Ophestra
2d4cabe786 nix: increase nixfmt max width 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-02-28 14:43:46 +09:00
Ophestra
673b648bd3 cmd/fpkg: call app in-process 
Wrapping fortify is slow, painful and error-prone. Start apps in-process instead.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-02-26 19:51:44 +09:00
Ophestra
c21a4cff14 nix: wrap fpkg 
This is usable on nixos now due to the static build.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-02-26 12:24:04 +09:00
Ophestra
6d4ac3d9fd internal: store fortify path in internal 
This now makes more sense due to the changes in build system.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-02-26 12:03:25 +09:00
Ophestra
751aa350ee nix: exclude files ending in ".py" 
This reduces rebuilds when debugging nixos tests.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-02-24 17:41:56 +09:00
Ophestra
71135f339a release: 0.2.18 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-02-23 18:52:33 +09:00
Ophestra
8bf162820b nix: separate fsu from package 
This appears to be the only way to build them with different configuration. This enables static linking in the main package.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-02-23 18:13:37 +09:00
Ophestra
2e7e160683 release: 0.2.17 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-02-23 02:59:31 +09:00
Ophestra
9d9a165379 release: 0.2.16 
Mostly refactor and cleanup, but also contains major fix to process lifecycle management.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-02-19 23:39:16 +09:00
Ophestra
83e72c2b59 release: 0.2.15 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-02-17 00:13:04 +09:00
Ophestra
90b86a5531 release: 0.2.14 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-02-15 23:05:02 +09:00
Ophestra
820f48ef94 release: 0.2.13 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-02-13 23:45:54 +09:00
Ophestra
21735a8abe release: 0.2.12 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-01-25 13:40:48 +09:00
Ophestra
7106b00968 release: 0.2.11 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-01-23 20:49:49 +09:00
Ophestra
3df344828f proc/priv/shim: seccomp bpf filter via libseccomp 
Rulesets adapted from Flatpak for compatibility.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-01-20 23:39:47 +09:00
Ophestra
1ec901f79e release: 0.2.10 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-01-18 22:50:08 +09:00
Ophestra
7baca66a56 proc: remove duplicate compile-time fortify reference 
This is no longer needed since shim and init are now part of the main program.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-01-18 11:59:33 +09:00
Ophestra
27d2914286 proc/priv/init: merge init into main program 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-01-18 11:47:01 +09:00
Ophestra
ea8f228af3 proc/priv/shim: merge shim into main program 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-01-17 23:43:32 +09:00
Ophestra
c4de450217 nix: do not force static linking on nix 
In a typical Nix or NixOS-based setup, the entire /nix/store directory is available to the sandbox.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-01-17 22:56:16 +09:00
Ophestra
b60c01f440 fortify: switch to static linking 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-01-16 17:32:52 +09:00
Ophestra
be4d8b6300 release: 0.2.9 
This release mostly contains permissive defaults fixes and optimisations. It also contains a proof of concept version of fpkg.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-01-15 13:14:43 +09:00
Ophestra
bf8094c6ca internal: include path to fortify main program 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2024-12-26 12:48:48 +09:00
Ophestra
2e3bb1893e release: 0.2.8 
This release mostly fixes bugs uncovered when running fortify on a generic linux distribution.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2024-12-29 01:09:47 +09:00
Ophestra
c109ac2653 release: 0.2.7 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2024-12-22 13:34:50 +09:00
Ophestra
5c73acb56f release: 0.2.6 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2024-12-22 01:18:21 +09:00
Ophestra
ed8ee5eb4b nix: filter nix files from src 
This prevents constant rebuilds when debugging integration tests.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2024-12-21 17:39:42 +09:00