hakurei

Author	SHA1	Message	Date
cat	45ad788c6d	cmd/fsu: allow switch from fpkg Test / Create distribution (push) Successful in 32s Details Test / Fortify (push) Successful in 2m12s Details Test / Data race detector (push) Successful in 2m30s Details Test / Fpkg (push) Successful in 3m8s Details Test / Flake checks (push) Successful in 49s Details Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-02-26 19:42:28 +09:00
cat	8bf162820b	nix: separate fsu from package Test / Create distribution (push) Successful in 26s Details Test / Run NixOS test (push) Successful in 7m25s Details This appears to be the only way to build them with different configuration. This enables static linking in the main package. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-02-23 18:13:37 +09:00
cat	1fd571d561	cmd/fsu: check parse behaviour Test / Run NixOS test (push) Successful in 10m33s Details Test / Create distribution (push) Successful in 1m8s Details Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-02-14 16:43:55 +09:00
cat	be30e2f11e	cmd/fsu: revert offset in error message Test / Create distribution (push) Successful in 51s Details Test / Run NixOS test (push) Successful in 3m39s Details Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-02-14 15:31:39 +09:00
cat	ea8f228af3	proc/priv/shim: merge shim into main program Build / Create distribution (push) Successful in 2m15s Details Test / Run NixOS test (push) Successful in 2m53s Details Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-01-17 23:43:32 +09:00
cat	52f21a19f3	cmd/fshim: switch to setup pipe Tests / Go tests (push) Successful in 38s Details Nix / NixOS tests (push) Successful in 5m43s Details The socket-based approach is no longer necessary as fsu allows extra files and sudo compatibility is no longer relevant. Signed-off-by: Ophestra Umiker <cat@ophivana.moe>	2024-12-18 19:39:25 +09:00
cat	b453f70ca2	cmd/fsu: check uid range before syscall Tests / Go tests (push) Successful in 43s Details Nix / NixOS tests (push) Successful in 5m0s Details This limits potential exploits to the fortify uid range. Signed-off-by: Ophestra Umiker <cat@ophivana.moe>	2024-12-17 13:01:36 +09:00
cat	df33123bd7	app: integrate fsu test / test (push) Successful in 21s Details This removes the dependency on external user switchers like sudo/machinectl and decouples fortify user ids from the passwd database. Signed-off-by: Ophestra Umiker <cat@ophivana.moe>	2024-11-16 21:19:45 +09:00
cat	45fead18c3	cmd/fshim: set no_new_privs flag Signed-off-by: Ophestra Umiker <cat@ophivana.moe>	2024-11-09 11:50:56 +09:00
cat	88abcbe0b2	cmd/fsu: remove import of internal package test / test (push) Successful in 24s Details Signed-off-by: Ophestra Umiker <cat@ophivana.moe>	2024-11-04 12:32:14 +09:00
cat	584732f80a	cmd: shim and init into separate binaries test / test (push) Successful in 19s Details This change also fixes a deadlock when shim fails to connect and complete the setup. Signed-off-by: Ophestra Umiker <cat@ophivana.moe>	2024-11-02 03:13:57 +09:00
cat	aa1f96eeeb	fsu: check parent executable path test / test (push) Successful in 19s Details Only allow main program to launch fsu. This change and further checks in the main program reduces attack surface. Signed-off-by: Ophestra Umiker <cat@ophivana.moe>	2024-10-28 18:52:23 +09:00
cat	d9cb2a9f2b	fsu: implement simple setuid user switcher Contains path to fortify, set at compile time, authenticates based on a simple uid range assignment file which also acts as the allow list. Signed-off-by: Ophestra Umiker <cat@ophivana.moe>	2024-10-28 00:02:34 +09:00