100 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
cat	7be53a2438	cmd/fshim: switch to generic setup func ... Signed-off-by: Ophestra Umiker <cat@ophivana.moe>	2024-12-18 17:20:31 +09:00
cat	7f29b37a32	proc: setup payload send ... Generic setup payload encoder adapted from fshim. Signed-off-by: Ophestra Umiker <cat@ophivana.moe>	2024-12-18 17:20:01 +09:00
cat	f69e8e753e	cmd/finit: switch to generic receive func ... Signed-off-by: Ophestra Umiker <cat@ophivana.moe>	2024-12-18 16:49:19 +09:00
cat	ef8fd37e9d	proc: setup payload receive ... Generic implementation of setup payload receiver adapted from finit. Signed-off-by: Ophestra Umiker <cat@ophivana.moe>	2024-12-18 16:48:41 +09:00
cat	2f676c9d6e	fst: rename from fipc ... Signed-off-by: Ophestra Umiker <cat@ophivana.moe>	2024-12-18 15:50:46 +09:00
cat	bbace8f84b	nix: increase cpu count ... This improves performance, especially when kvm is inaccessible. Signed-off-by: Ophestra Umiker <cat@ophivana.moe>	2024-12-18 15:32:52 +09:00
cat	2efedf56c0	nix: collect fortify ps output ... Signed-off-by: Ophestra Umiker <cat@ophivana.moe>	2024-12-18 13:48:39 +09:00
cat	b752ec4468	fipc: export config struct ... Also store full config as part of state. Signed-off-by: Ophestra Umiker <cat@ophivana.moe>	2024-12-18 13:45:55 +09:00
cat	5d00805a7c	nix: check acl rollback ... Signed-off-by: Ophestra Umiker <cat@ophivana.moe>	2024-12-18 12:49:32 +09:00
cat	7b6052a473	nix: run Go tests in nixos ... Nix build environment does not support ACLs in any filesystem. This allows acl tests to run. Signed-off-by: Ophestra Umiker <cat@ophivana.moe>	2024-12-17 21:16:55 +09:00
cat	38653c6ab5	release: 0.2.3 ... Signed-off-by: Ophestra Umiker <cat@ophivana.moe>	2024-12-17 14:06:17 +09:00
cat	b5cbbeab90	dist: generate distribution tarball ... Signed-off-by: Ophestra Umiker <cat@ophivana.moe>	2024-12-17 14:02:54 +09:00
cat	c3ba0c3cce	nix: rename nixos test ... Signed-off-by: Ophestra Umiker <cat@ophivana.moe>	2024-12-17 13:02:12 +09:00
cat	b453f70ca2	cmd/fsu: check uid range before syscall ... This limits potential exploits to the fortify uid range. Signed-off-by: Ophestra Umiker <cat@ophivana.moe>	2024-12-17 13:01:36 +09:00
cat	c2b178e626	xcb: refactor and clean up ... No clean way to write Go tests for this package. Will rely on NixOS tests for now. Signed-off-by: Ophestra Umiker <cat@ophivana.moe>	2024-12-17 12:46:36 +09:00
cat	aeda40fc92	nix: test x11 permissive defaults ... Also invoke glinfo/wayland-info as part of tests. Signed-off-by: Ophestra Umiker <cat@ophivana.moe>	2024-12-17 12:40:29 +09:00
cat	65dc39956f	workflows: set action names ... Signed-off-by: Ophestra Umiker <cat@ophivana.moe>	2024-12-17 11:12:39 +09:00
cat	35505c8a26	workflows: invoke nix flake checks ... Integration tests are implemented as nix flake checks. Signed-off-by: Ophestra Umiker <cat@ophivana.moe>	2024-12-17 10:49:43 +09:00
cat	3f993021f8	nix: permissive defaults nixos test ... Adapted from nixos sway integration tests. Signed-off-by: Ophestra Umiker <cat@ophivana.moe>	2024-12-16 22:56:10 +09:00
cat	4d3bd5338f	nix: implement flake checks ... Signed-off-by: Ophestra Umiker <cat@ophivana.moe>	2024-12-16 20:54:28 +09:00
cat	138666d753	nix: skip acl test ... The nix build environment does not support ACLs. Signed-off-by: Ophestra Umiker <cat@ophivana.moe>	2024-12-16 19:29:01 +09:00
cat	f4628e181b	acl: create test file in tmpdir ... Signed-off-by: Ophestra Umiker <cat@ophivana.moe>	2024-12-16 18:58:09 +09:00
cat	c8a90666c5	acl: refactor and clean up ... Move all C code to c.go, switch to pkg-config, set up finalizer for acl. Signed-off-by: Ophestra Umiker <cat@ophivana.moe>	2024-12-16 18:27:19 +09:00
cat	ee41b37606	acl: add tests ... These tests test UpdatePerm correctness by parsing getfacl output. Signed-off-by: Ophestra Umiker <cat@ophivana.moe>	2024-12-16 16:00:31 +09:00
cat	e3f1d7ba60	release: 0.2.2 ... Signed-off-by: Ophestra Umiker <cat@ophivana.moe>	2024-12-07 21:47:22 +09:00
cat	39e3ac3ccd	nix: require /etc/userdb nix-daemon ... There seems to be some kind of credential caching in nix-daemon. Signed-off-by: Ophestra Umiker <cat@ophivana.moe>	2024-12-07 21:07:57 +09:00
cat	33c95b80ca	cmd/fuserdb: rename home directories ... Signed-off-by: Ophestra Umiker <cat@ophivana.moe>	2024-12-07 20:23:46 +09:00
cat	40cc8a68d1	nix: rename home directories ... Signed-off-by: Ophestra Umiker <cat@ophivana.moe>	2024-12-07 20:15:37 +09:00
cat	f773c92411	system: prevent duplicate Wayland op ... Wayland is implemented as an Op to enforce dependency and cleanup, its implementation does not allow multiple instances on a single sys object, nor would doing that make any sense. Signed-off-by: Ophestra Umiker <cat@ophivana.moe>	2024-12-07 19:45:37 +09:00
cat	16ab734fcd	update README document ... A lot of this information is no longer true since fsu. Remove them for now and write up proper documentation later. Signed-off-by: Ophestra Umiker <cat@ophivana.moe>	2024-12-06 17:04:36 +09:00
cat	cc816a1aaa	proc: cleaner extra files ... Signed-off-by: Ophestra Umiker <cat@ophivana.moe>	2024-12-06 16:05:04 +09:00
cat	b3ef53b193	app: integrate security-context-v1 ... Should be able to get rid of XDG_RUNTIME_DIR share after this. Signed-off-by: Ophestra Umiker <cat@ophivana.moe>	2024-12-06 04:25:33 +09:00
cat	8d0573405a	helper/bwrap: implement sync fd ... This is required by wayland security-context-v1. Signed-off-by: Ophestra Umiker <cat@ophivana.moe>	2024-12-06 04:21:37 +09:00
cat	38e92edb8e	system/wayland: integrate security-context-v1 ... Had to pass the sync fd through sys. The rest are just part of a standard Op. Signed-off-by: Ophestra Umiker <cat@ophivana.moe>	2024-12-06 04:20:15 +09:00
cat	2d606b1f4b	wl: implement security-context-v1 ... Signed-off-by: Ophestra Umiker <cat@ophivana.moe>	2024-12-06 04:15:13 +09:00
cat	1b5b089c78	fortify: rename --dbus-id to --id ... This value is no longer specific to D-Bus defaults. Signed-off-by: Ophestra Umiker <cat@ophivana.moe>	2024-12-06 03:26:09 +09:00
cat	6b8ddca7b4	nix: track nixos stable 24.11 ... Reduce rebuilds during development on my system. Signed-off-by: Ophestra Umiker <cat@ophivana.moe>	2024-12-06 00:44:04 +09:00
cat	95668ac998	nix: expose no_new_session in module ... Useful for shells and terminal programs like chat clients. Signed-off-by: Ophestra Umiker <cat@ophivana.moe>	2024-11-28 00:19:06 +09:00
cat	b291f0b710	app: add nixos-based config test case ... Signed-off-by: Ophestra Umiker <cat@ophivana.moe>	2024-11-21 12:13:21 +09:00
cat	3a20b149ce	update README document ... Signed-off-by: Ophestra Umiker <cat@ophivana.moe>	2024-11-21 11:22:34 +09:00
cat	30b8bce90a	fortify: zsh completion ... Signed-off-by: Ophestra Umiker <cat@ophivana.moe>	2024-11-20 01:25:19 +09:00
cat	de0d78daae	release: 0.2.1 ... Signed-off-by: Ophestra Umiker <cat@ophivana.moe>	2024-11-19 21:03:50 +09:00
cat	6bf33ce507	fortify: use resolved username ... Signed-off-by: Ophestra Umiker <cat@ophivana.moe>	2024-11-19 21:03:09 +09:00
cat	9faf3b3596	app: validate username ... This value is used for passwd generation. Bad input can cause very confusing issues. This is not a security issue, however validation will improve user experience. Signed-off-by: Ophestra Umiker <cat@ophivana.moe>	2024-11-19 21:01:41 +09:00
cat	d99c8b1fb4	release: 0.2.0 ... Signed-off-by: Ophestra Umiker <cat@ophivana.moe>	2024-11-19 18:15:09 +09:00
cat	6e4870775f	update README document ... Signed-off-by: Ophestra Umiker <cat@ophivana.moe>	2024-11-19 18:14:06 +09:00
cat	0a546885e3	nix: update options doc ... Signed-off-by: Ophestra Umiker <cat@ophivana.moe>	2024-11-19 18:12:35 +09:00
cat	653d69da0a	nix: module descriptions ... Signed-off-by: Ophestra Umiker <cat@ophivana.moe>	2024-11-19 18:10:57 +09:00
cat	f8256137ae	nix: separate module options from implementation ... Signed-off-by: Ophestra Umiker <cat@ophivana.moe>	2024-11-19 17:08:22 +09:00
cat	54b47b0315	nix: copy pixmaps directory to share package ... Signed-off-by: Ophestra Umiker <cat@ophivana.moe>	2024-11-18 14:46:08 +09:00
cat	ae2628e57a	cmd/fshim/ipc: install signal handler on shim start ... Getting killed at this point will result in inconsistent state. Signed-off-by: Ophestra Umiker <cat@ophivana.moe>	2024-11-18 13:33:46 +09:00
cat	c026a4b5dc	fortify: permissive defaults resolve home directory from os ... When starting with the permissive defaults "run" command, attempt to resolve home directory from os by default and fall back to /var/empty. Signed-off-by: Ophestra Umiker <cat@ophivana.moe>	2024-11-18 13:01:07 +09:00
cat	748a0ae2c8	nix: wrap program from libexec ... This avoids renaming the fortify binary. Signed-off-by: Ophestra Umiker <cat@ophivana.moe>	2024-11-18 12:58:47 +09:00
cat	8f3f0c7bbf	nix: integrate dynamic users ... Signed-off-by: Ophestra Umiker <cat@ophivana.moe>	2024-11-18 02:49:48 +09:00
cat	05b7dbf066	app: alternative inner home path ... Support binding home to an alternative path in the mount namespace. Signed-off-by: Ophestra Umiker <cat@ophivana.moe>	2024-11-18 00:18:21 +09:00
cat	866270ff05	fmsg: add to wg prior to enqueue ... Adding after channel write is racy. Signed-off-by: Ophestra Umiker <cat@ophivana.moe>	2024-11-17 23:50:02 +09:00
cat	c1fad649e8	app/start: check for cleanup and abort condition ... Dirty fix. Will rewrite after fsu integration complete. Signed-off-by: Ophestra Umiker <cat@ophivana.moe>	2024-11-17 23:41:52 +09:00
cat	b5f01ef20b	app: append # for ChangeHosts message with numerical uid ... Signed-off-by: Ophestra Umiker <cat@ophivana.moe>	2024-11-17 23:40:37 +09:00
cat	2e23cef7bb	cmd/fuserdb: generate group entries ... Signed-off-by: Ophestra Umiker <cat@ophivana.moe>	2024-11-17 23:31:06 +09:00
cat	6a6d30af1f	cmd/fuserdb: systemd userdb drop-in entries generator ... This provides user records via nss-systemd. Static drop-in entries are generated to reduce complexity and attack surface. Signed-off-by: Ophestra Umiker <cat@ophivana.moe>	2024-11-17 02:16:02 +09:00
cat	df33123bd7	app: integrate fsu ... This removes the dependency on external user switchers like sudo/machinectl and decouples fortify user ids from the passwd database. Signed-off-by: Ophestra Umiker <cat@ophivana.moe>	2024-11-16 21:19:45 +09:00
cat	1a09b55bd4	nix: remove portal paths from default ... Despite presenting itself as a generic desktop integration interface, xdg-desktop portal is highly flatpak-centric and only supports flatpak and snap in practice. It is a significant attack surface to begin with as it is a privileged process which accepts input from unprivileged processes, and the lack of support for anything other than fortify also introduces various information leaks when exposed to fortify as it treats fortified programs as unsandboxed, privileged programs in many cases. Signed-off-by: Ophestra Umiker <cat@ophivana.moe>	2024-11-10 22:24:17 +09:00
cat	9a13b311ac	app/config: rename map_real_uid from use_real_uid ... This option only changes mapped uid in the user namespace. Signed-off-by: Ophestra Umiker <cat@ophivana.moe>	2024-11-09 12:01:34 +09:00
cat	45fead18c3	cmd/fshim: set no_new_privs flag ... Signed-off-by: Ophestra Umiker <cat@ophivana.moe>	2024-11-09 11:50:56 +09:00
cat	431aa32291	nix: remove absolute Exec paths ... Absolute paths set for Exec causes the program to be launched as the privileged user. Signed-off-by: Ophestra Umiker <cat@ophivana.moe>	2024-11-08 02:05:47 +09:00
cat	3962705126	nix: keep fshim and finit names ... Signed-off-by: Ophestra Umiker <cat@ophivana.moe>	2024-11-06 14:59:28 +09:00
cat	ad80be721b	nix: improve start script ... Zsh store path in shebang. Replace writeShellScript with writeScript since runtimeShell is not overridable. Signed-off-by: Ophestra Umiker <cat@ophivana.moe>	2024-11-06 14:09:41 +09:00
cat	f831948bca	release: 0.1.0 ... This release significantly changes the command line interface, and updates the NixOS module to finally produce meaningful sandbox configuration. Signed-off-by: Ophestra Umiker <cat@ophivana.moe>	2024-11-06 04:37:43 +09:00
cat	2e31b3d3a1	update README document ... Signed-off-by: Ophestra Umiker <cat@ophivana.moe>	2024-11-06 04:35:52 +09:00
cat	4d90e73366	nix: generate strict sandbox configuration ... Signed-off-by: Ophestra Umiker <cat@ophivana.moe>	2024-11-06 04:25:15 +09:00
cat	3dfc1fcd56	app: support full /dev access ... Also moved /dev/fortify to /fortify since it is impossible to create new directories in /dev from the init namespace and bind mounting its contents has undesirable side effects. Signed-off-by: Ophestra Umiker <cat@ophivana.moe>	2024-11-06 03:49:39 +09:00
cat	89bafd0c22	fortify: root check before command handling ... Signed-off-by: Ophestra Umiker <cat@ophivana.moe>	2024-11-05 12:57:03 +09:00
cat	861bb1274f	fortify: override default usage function ... Signed-off-by: Ophestra Umiker <cat@ophivana.moe>	2024-11-05 00:12:31 +09:00
cat	714818c8aa	fortify: implement cleaner argument structure ... Signed-off-by: Ophestra Umiker <cat@ophivana.moe>	2024-11-05 00:07:36 +09:00
cat	69cc64ef56	linux: provide access to stdout ... Signed-off-by: Ophestra Umiker <cat@ophivana.moe>	2024-11-04 22:55:46 +09:00
cat	fc25ac2523	app: separate auto etc from permissive defaults ... Populating /etc with symlinks is quite useful even outside the permissive defaults usage pattern. Signed-off-by: Ophestra Umiker <cat@ophivana.moe>	2024-11-04 22:18:05 +09:00
cat	d909b1190a	app/config: UseRealUID as true in template ... The template is based on a Chromium setup, which this workaround was created for. Signed-off-by: Ophestra Umiker <cat@ophivana.moe>	2024-11-04 19:45:31 +09:00
cat	cfd05b10f1	release: 0.0.11 ... This will be the final release before major command line interface changes. This version is tagged as it contains many fixes that still impacts the permissive defaults usage pattern. Signed-off-by: Ophestra Umiker <cat@ophivana.moe>	2024-11-04 13:46:47 +09:00
cat	aa067436a7	workflows: build all packages with full ldflags ... Signed-off-by: Ophestra Umiker <cat@ophivana.moe>	2024-11-04 13:43:57 +09:00
cat	d7df24c999	fmsg: drop messages when msgbuf is full during withhold ... Logging functions are not expected to block. This change fixes multiple hangs where more than 64 messages are produced during withhold. Signed-off-by: Ophestra Umiker <cat@ophivana.moe>	2024-11-04 12:56:19 +09:00
cat	88abcbe0b2	cmd/fsu: remove import of internal package ... Signed-off-by: Ophestra Umiker <cat@ophivana.moe>	2024-11-04 12:32:14 +09:00
cat	af15b1c048	app: support mapping target uid as privileged uid in sandbox ... Chromium's D-Bus client implementation refuses to work when its getuid call returns a different value than what the D-Bus server is running as. The reason behind this is not fully understood, but this workaround is implemented to support chromium and electron apps. This is not used by default since it has many side effects that break many other programs, like SSH on NixOS. Signed-off-by: Ophestra Umiker <cat@ophivana.moe>	2024-11-04 03:15:39 +09:00
cat	7962681f4a	app: format mapped uid instead of real uid ... Signed-off-by: Ophestra Umiker <cat@ophivana.moe>	2024-11-04 00:49:32 +09:00
cat	bfcce3ff75	system/dbus: buffer xdg-dbus-proxy messages ... Pointing xdg-dbus-proxy to stdout/stderr makes a huge mess. This change enables app to neatly print out prefixed xdg-dbus-proxy messages after output is resumed. Signed-off-by: Ophestra Umiker <cat@ophivana.moe>	2024-11-03 03:07:02 +09:00
cat	8cd3651bb6	cmd/fshim/ipc: friendly setup timeout message ... This message eventually gets returned by the app's Start method, so they should be wrapped to provide a friendly message. Signed-off-by: Ophestra Umiker <cat@ophivana.moe>	2024-11-03 02:03:30 +09:00
cat	422d8e00d5	fortify: replace direct syscall with prctl wrapper ... Signed-off-by: Ophestra Umiker <cat@ophivana.moe>	2024-11-02 17:00:25 +09:00
cat	584732f80a	cmd: shim and init into separate binaries ... This change also fixes a deadlock when shim fails to connect and complete the setup. Signed-off-by: Ophestra Umiker <cat@ophivana.moe>	2024-11-02 03:13:57 +09:00
cat	4b7b899bb3	add package doc comments ... Signed-off-by: Ophestra Umiker <cat@ophivana.moe>	2024-10-28 20:57:59 +09:00
cat	563c39c2d9	release: 0.0.10 ... Signed-off-by: Ophestra Umiker <cat@ophivana.moe>	2024-10-28 20:38:10 +09:00
cat	aa1f96eeeb	fsu: check parent executable path ... Only allow main program to launch fsu. This change and further checks in the main program reduces attack surface. Signed-off-by: Ophestra Umiker <cat@ophivana.moe>	2024-10-28 18:52:23 +09:00
cat	431dc095e5	app/start: skip cleanup if shim is nil ... Shim is created before any system operation happens. Signed-off-by: Ophestra Umiker <cat@ophivana.moe>	2024-10-28 14:21:15 +09:00
cat	60e91b9b0f	shim: expose checkPid in constructor ... This will be supported soon when launching via fsu. Signed-off-by: Ophestra Umiker <cat@ophivana.moe>	2024-10-28 00:02:55 +09:00
cat	d9cb2a9f2b	fsu: implement simple setuid user switcher ... Contains path to fortify, set at compile time, authenticates based on a simple uid range assignment file which also acts as the allow list. Signed-off-by: Ophestra Umiker <cat@ophivana.moe>	2024-10-28 00:02:34 +09:00
cat	09feda3783	fortify: exit if seal returns error ... Wait should not be called on an unsealed App. Signed-off-by: Ophestra Umiker <cat@ophivana.moe>	2024-10-27 23:18:16 +09:00
cat	51e84ba8a5	system/dbus: compare sealed value by string ... Stringer method of dbus.Proxy returns a string representation of its args stream when sealed. Signed-off-by: Ophestra Umiker <cat@ophivana.moe>	2024-10-27 12:09:34 +09:00
cat	7df9d8d01d	system: move sd_booted implementation to os abstraction ... This implements lazy loading of the systemd marker (they are not accessed in init and shim) and ensures consistent behaviour when running with a stub. Signed-off-by: Ophestra Umiker <cat@ophivana.moe>	2024-10-27 12:09:34 +09:00
cat	6d8bcb63f2	release: 0.0.9 ... Signed-off-by: Ophestra Umiker <cat@ophivana.moe>	2024-10-27 01:25:24 +09:00
cat	c7b77d6e5e	fmsg: initialise dequeue prior to withhold/resume ... This fixes the hang on resume when no messages were ever printed. Signed-off-by: Ophestra Umiker <cat@ophivana.moe>	2024-10-27 01:24:30 +09:00
cat	2f34627d37	release: 0.0.8 ... Signed-off-by: Ophestra Umiker <cat@ophivana.moe>	2024-10-27 00:49:50 +09:00
cat	1d6ea81205	shim: user switcher process management struct ... This change moves all user switcher and shim management to the shim package and withholds output while shim is alive. This also eliminated all exit scenarios where revert is skipped. Signed-off-by: Ophestra Umiker <cat@ophivana.moe>	2024-10-27 00:46:15 +09:00