This provides user records via nss-systemd. Static drop-in entries are generated to reduce complexity and attack surface.
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
This removes the dependency on external user switchers like sudo/machinectl and decouples fortify user ids from the passwd database.
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
This release significantly changes the command line interface, and updates the NixOS module to finally produce meaningful sandbox configuration.
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
This will be the final release before major command line interface changes. This version is tagged as it contains many fixes that still impacts the permissive defaults usage pattern.
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
Only allow main program to launch fsu. This change and further checks in the main program reduces attack surface.
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
Contains path to fortify, set at compile time, authenticates based on a simple uid range assignment file which also acts as the allow list.
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
This project started as a Go implementation of https://github.com/intgr/ego. That is clearly no longer what it is anymore and the tagged releases no longer made sense, so we're going back to v0.
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
