fortify

Author	SHA1	Message	Date
Ophestra	7106b00968	release: 0.2.11 All checks were successful Build / Create distribution (push) Successful in 3m51s Details Release / Create release (push) Successful in 4m12s Details Test / Run NixOS test (push) Successful in 6m17s Details Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-01-23 20:49:49 +09:00
Ophestra	96d5d8a396	nix: apply shared home config to reserved aid All checks were successful Build / Create distribution (push) Successful in 2m16s Details Test / Run NixOS test (push) Successful in 5m43s Details Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-01-23 20:48:04 +09:00
Ophestra	8a00a83c71	nix: expose syscall filter policy All checks were successful Build / Create distribution (push) Successful in 1m31s Details Test / Run NixOS test (push) Successful in 1m52s Details Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-01-23 17:24:42 +09:00
Ophestra	134247b57d	nix: configure target users via nixos All checks were successful Build / Create distribution (push) Successful in 2m0s Details Test / Run NixOS test (push) Successful in 3m46s Details This makes patching home-manager no longer necessary. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-01-23 17:04:19 +09:00
Ophestra	b5bb7654da	nix: redirect sway output to journal All checks were successful Build / Create distribution (push) Successful in 2m8s Details Test / Run NixOS test (push) Successful in 3m58s Details This makes swaymsg exec output appear in test output. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-01-23 16:08:22 +09:00
Ophestra	cc1efa22e2	fst: add missing fields to template All checks were successful Build / Create distribution (push) Successful in 1m28s Details Test / Run NixOS test (push) Successful in 3m43s Details Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-01-22 12:09:25 +09:00
Ophestra	580128922b	cmd/fpkg: expose syscall policy options All checks were successful Build / Create distribution (push) Successful in 1m34s Details Test / Run NixOS test (push) Successful in 3m44s Details Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-01-22 12:01:30 +09:00
Ophestra	23e1152baa	app/share: clean BaseError message All checks were successful Build / Create distribution (push) Successful in 1m35s Details Test / Run NixOS test (push) Successful in 3m42s Details This removes trailing '\n' in the PulseAudio warning. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-01-22 11:54:16 +09:00
Ophestra	8c51012ef5	dbus: enable syscall filter All checks were successful Build / Create distribution (push) Successful in 1m33s Details Test / Run NixOS test (push) Successful in 3m42s Details Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-01-22 11:49:23 +09:00
Ophestra	5a64cdaf4f	ldd: enable syscall filter All checks were successful Build / Create distribution (push) Successful in 1m55s Details Test / Run NixOS test (push) Successful in 4m6s Details Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-01-22 02:00:49 +09:00
Ophestra	a30f5e1226	fortify: set up seccomp verbose logging early All checks were successful Build / Create distribution (push) Successful in 1m34s Details Test / Run NixOS test (push) Successful in 4m4s Details Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-01-22 01:58:54 +09:00
Ophestra	9a239fa1a5	helper/bwrap: integrate seccomp into helper interface All checks were successful Build / Create distribution (push) Successful in 1m36s Details Test / Run NixOS test (push) Successful in 3m40s Details This makes API usage much cleaner, and encapsulates all bwrap arguments in argsWt. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-01-22 01:52:57 +09:00
Ophestra	82029948e6	proc: append to ExtraFiles slice pointer All checks were successful Build / Create distribution (push) Successful in 1m30s Details Test / Run NixOS test (push) Successful in 4m4s Details This is useful for initialising extra files before command. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-01-21 12:51:39 +09:00
Ophestra	dfcdc5ce20	state: store config in separate gob stream All checks were successful Build / Create distribution (push) Successful in 1m37s Details Test / Run NixOS test (push) Successful in 3m38s Details This enables early serialisation of config. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-01-21 12:10:58 +09:00
Ophestra	fa0616b274	fortify: print permissive defaults warning early All checks were successful Build / Create distribution (push) Successful in 1m47s Details Test / Run NixOS test (push) Successful in 4m1s Details Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-01-21 12:05:31 +09:00
Ophestra	20a3d4c458	proc/priv/shim: resolve and load seccomp rules All checks were successful Build / Create distribution (push) Successful in 1m33s Details Test / Run NixOS test (push) Successful in 3m36s Details Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-01-20 23:52:56 +09:00
Ophestra	3df344828f	proc/priv/shim: seccomp bpf filter via libseccomp All checks were successful Build / Create distribution (push) Successful in 1m59s Details Test / Run NixOS test (push) Successful in 4m11s Details Rulesets adapted from Flatpak for compatibility. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-01-20 23:39:47 +09:00
Ophestra	27f5922d5c	fst: include syscall filter configuration All checks were successful Build / Create distribution (push) Successful in 3m0s Details Test / Run NixOS test (push) Successful in 5m19s Details This value is passed through to shim. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-01-20 21:12:39 +09:00
Ophestra	2cf1f46ea2	nix: test show without --short All checks were successful Build / Create distribution (push) Successful in 3m36s Details Test / Run NixOS test (push) Successful in 6m45s Details Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-01-20 21:10:24 +09:00
Ophestra	3c55fc8e86	proc/priv/shim: do not log bwrap args All checks were successful Build / Create distribution (push) Successful in 1m22s Details Test / Run NixOS test (push) Successful in 3m30s Details This message is very long and does not serve much real purpose. Remove it to de-clutter verbose messages. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-01-20 19:51:28 +09:00
Ophestra	eb0ef2d115	helper/bwrap: generic extra file interface All checks were successful Build / Create distribution (push) Successful in 1m32s Details Test / Run NixOS test (push) Successful in 3m50s Details Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-01-20 00:20:04 +09:00
Ophestra	2f70506865	helper/bwrap: move sync to helper state All checks were successful Build / Create distribution (push) Successful in 1m25s Details Test / Run NixOS test (push) Successful in 3m33s Details Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-01-19 18:38:13 +09:00
Ophestra	cae567c109	proc/priv/shim: remove unnecessary state All checks were successful Build / Create distribution (push) Successful in 1m27s Details Test / Run NixOS test (push) Successful in 3m37s Details These values are only used during process creation. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-01-19 18:09:07 +09:00
Ophestra	1ec901f79e	release: 0.2.10 All checks were successful Build / Create distribution (push) Successful in 1m32s Details Test / Run NixOS test (push) Successful in 3m39s Details Release / Create release (push) Successful in 1m30s Details Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-01-18 22:50:08 +09:00
Ophestra	715addaccd	helper/bwrap: append --sync-fd before -- All checks were successful Build / Create distribution (push) Successful in 1m26s Details Test / Run NixOS test (push) Successful in 3m26s Details Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-01-18 12:30:03 +09:00
Ophestra	b31d055e20	proc/priv/init: early init check All checks were successful Build / Create distribution (push) Successful in 1m39s Details Test / Run NixOS test (push) Successful in 3m45s Details Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-01-18 12:33:33 +09:00
Ophestra	7baca66a56	proc: remove duplicate compile-time fortify reference All checks were successful Build / Create distribution (push) Successful in 1m46s Details Test / Run NixOS test (push) Successful in 3m44s Details This is no longer needed since shim and init are now part of the main program. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-01-18 11:59:33 +09:00
Ophestra	27d2914286	proc/priv/init: merge init into main program All checks were successful Build / Create distribution (push) Successful in 1m47s Details Test / Run NixOS test (push) Successful in 3m46s Details Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-01-18 11:47:01 +09:00
Ophestra	ea8f228af3	proc/priv/shim: merge shim into main program All checks were successful Build / Create distribution (push) Successful in 2m15s Details Test / Run NixOS test (push) Successful in 2m53s Details Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-01-17 23:43:32 +09:00
Ophestra	16db3dabe2	internal: do PR_SET_PDEATHSIG once All checks were successful Build / Create distribution (push) Successful in 3m7s Details Test / Run NixOS test (push) Successful in 4m40s Details This prctl affects the entire process, doing it on every OS thread is pointless. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-01-17 23:08:46 +09:00
Ophestra	c4de450217	nix: do not force static linking on nix All checks were successful Build / Create distribution (push) Successful in 3m14s Details Test / Run NixOS test (push) Successful in 3m25s Details In a typical Nix or NixOS-based setup, the entire /nix/store directory is available to the sandbox. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-01-17 22:56:16 +09:00
Ophestra	b60c01f440	fortify: switch to static linking All checks were successful Build / Create distribution (push) Successful in 1m43s Details Test / Run NixOS test (push) Successful in 4m32s Details Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-01-16 17:32:52 +09:00
Ophestra	124743ffd3	app: expose single run method All checks were successful Tests / Go tests (push) Successful in 1m1s Details Nix / NixOS tests (push) Successful in 3m20s Details App is no longer just a simple [exec.Cmd] wrapper, so exposing these steps separately no longer makes sense and actually hinders proper error handling, cleanup and cancellation. This change removes the five-second wait when the shim dies before receiving the payload, and provides caller the ability to gracefully stop execution of the confined process. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-01-15 23:39:51 +09:00
Ophestra	be4d8b6300	release: 0.2.9 All checks were successful Create distribution / Release (push) Successful in 1m21s Details Tests / Go tests (push) Successful in 46s Details Nix / NixOS tests (push) Successful in 3m6s Details This release mostly contains permissive defaults fixes and optimisations. It also contains a proof of concept version of fpkg. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-01-15 13:14:43 +09:00
Ophestra	3e11ce6868	helper/bwrap: separate sequential/static args All checks were successful Tests / Go tests (push) Successful in 41s Details Nix / NixOS tests (push) Successful in 3m59s Details Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-01-15 13:07:06 +09:00
Ophestra	562f5ed797	fst: hide sockets exposed via Filesystem All checks were successful Tests / Go tests (push) Successful in 40s Details Nix / NixOS tests (push) Successful in 2m49s Details This is mostly useful for permissive defaults. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-01-15 10:13:18 +09:00
Ophestra	db03565614	fst: move sandbox struct to separate file All checks were successful Tests / Go tests (push) Successful in 1m0s Details Nix / NixOS tests (push) Successful in 3m9s Details Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-01-15 09:42:44 +09:00
Ophestra	7d99e45b88	helper/bwrap: register OverlayConfig with gob All checks were successful Tests / Go tests (push) Successful in 58s Details Nix / NixOS tests (push) Successful in 3m5s Details This is required for copying bwrap configurations across processes. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-01-14 12:25:10 +09:00
Ophestra	1651eb06df	dbus: implement dbus_parse_address All checks were successful Tests / Go tests (push) Successful in 1m14s Details Nix / NixOS tests (push) Successful in 7m36s Details This parses D-Bus addresses according to spec. It does significantly fewer copies than dbus_parse_address. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-01-12 23:24:03 +09:00
Ophestra	ac543a1ce8	dbus: rename makeTestCases All checks were successful Tests / Go tests (push) Successful in 2m36s Details Nix / NixOS tests (push) Successful in 10m5s Details Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-01-12 23:21:28 +09:00
Ophestra	e2489059c1	helper/bwrap: implement overlayfs builder All checks were successful Tests / Go tests (push) Successful in 33s Details Nix / NixOS tests (push) Successful in 4m5s Details Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-01-05 20:09:35 +09:00
Ophestra	2e3f6a4c51	helper/bwrap: move test out of bwrap package All checks were successful Tests / Go tests (push) Successful in 36s Details Nix / NixOS tests (push) Successful in 4m51s Details Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-01-05 19:45:24 +09:00
Ophestra	2162029f46	helper/bwrap: add json struct tag to filesystem All checks were successful Tests / Go tests (push) Successful in 38s Details Nix / NixOS tests (push) Successful in 4m43s Details Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-01-05 19:41:04 +09:00
Ophestra	a1148edd00	fst/config: allocate filesystem slice All checks were successful Tests / Go tests (push) Successful in 32s Details Nix / NixOS tests (push) Successful in 4m5s Details Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-01-04 00:16:41 +09:00
Ophestra	6acd0d4e88	linux/std: handle fsu exit status 1 All checks were successful Tests / Go tests (push) Successful in 34s Details Nix / NixOS tests (push) Successful in 2m27s Details Printing "exit status 1" is confusing. This handles the ExitError and returns EACCES instead. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-01-01 21:34:57 +09:00
Ophestra	35b7142317	fortify: show system info when instance is not specified All checks were successful Tests / Go tests (push) Successful in 38s Details Nix / NixOS tests (push) Successful in 4m32s Details This contains useful information not obtainable by external tools. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-01-01 19:35:50 +09:00
Ophestra	c4d6651cae	update reverse-DNS style identifiers All checks were successful Tests / Go tests (push) Successful in 1m6s Details Nix / NixOS tests (push) Successful in 4m11s Details Signed-off-by: Ophestra <cat@gensokyo.uk>	2024-12-31 16:16:38 +09:00
Ophestra	22a4b99674	cmd/fpkg/install: deduplicate nix store All checks were successful Tests / Go tests (push) Successful in 41s Details Nix / NixOS tests (push) Successful in 4m43s Details Signed-off-by: Ophestra <cat@gensokyo.uk>	2024-12-30 02:25:04 +09:00
Ophestra	1464ef774b	cmd/fpkg: expose nixGL wrappers All checks were successful Tests / Go tests (push) Successful in 35s Details Nix / NixOS tests (push) Successful in 4m6s Details Signed-off-by: Ophestra <cat@gensokyo.uk>	2024-12-30 02:02:20 +09:00
Ophestra	66ba4cea5c	cmd/fpkg: remove workDir acl from activation All checks were successful Tests / Go tests (push) Successful in 33s Details Nix / NixOS tests (push) Successful in 3m56s Details Activation does not require access to workDir, and by this point all information is available in dataHome. Signed-off-by: Ophestra <cat@gensokyo.uk>	2024-12-29 23:48:45 +09:00

1 2 3 4 5 ...

414 Commits