1ec901f79e
release: 0.2.10
...
Build / Create distribution (push) Successful in 1m32s
Test / Run NixOS test (push) Successful in 3m39s
Release / Create release (push) Successful in 1m30s
Signed-off-by: Ophestra <cat@gensokyo.uk >
2025-01-18 22:50:08 +09:00
7baca66a56
proc: remove duplicate compile-time fortify reference
...
Build / Create distribution (push) Successful in 1m46s
Test / Run NixOS test (push) Successful in 3m44s
This is no longer needed since shim and init are now part of the main program.
Signed-off-by: Ophestra <cat@gensokyo.uk >
2025-01-18 11:59:33 +09:00
27d2914286
proc/priv/init: merge init into main program
...
Build / Create distribution (push) Successful in 1m47s
Test / Run NixOS test (push) Successful in 3m46s
Signed-off-by: Ophestra <cat@gensokyo.uk >
2025-01-18 11:47:01 +09:00
ea8f228af3
proc/priv/shim: merge shim into main program
...
Build / Create distribution (push) Successful in 2m15s
Test / Run NixOS test (push) Successful in 2m53s
Signed-off-by: Ophestra <cat@gensokyo.uk >
2025-01-17 23:43:32 +09:00
c4de450217
nix: do not force static linking on nix
...
Build / Create distribution (push) Successful in 3m14s
Test / Run NixOS test (push) Successful in 3m25s
In a typical Nix or NixOS-based setup, the entire /nix/store directory is available to the sandbox.
Signed-off-by: Ophestra <cat@gensokyo.uk >
2025-01-17 22:56:16 +09:00
b60c01f440
fortify: switch to static linking
...
Build / Create distribution (push) Successful in 1m43s
Test / Run NixOS test (push) Successful in 4m32s
Signed-off-by: Ophestra <cat@gensokyo.uk >
2025-01-16 17:32:52 +09:00
be4d8b6300
release: 0.2.9
...
Create distribution / Release (push) Successful in 1m21s
Tests / Go tests (push) Successful in 46s
Nix / NixOS tests (push) Successful in 3m6s
This release mostly contains permissive defaults fixes and optimisations. It also contains a proof of concept version of fpkg.
Signed-off-by: Ophestra <cat@gensokyo.uk >
2025-01-15 13:14:43 +09:00
bf8094c6ca
internal: include path to fortify main program
...
Tests / Go tests (push) Successful in 36s
Nix / NixOS tests (push) Successful in 4m6s
Signed-off-by: Ophestra <cat@gensokyo.uk >
2024-12-26 12:48:48 +09:00
2e3bb1893e
release: 0.2.8
...
Tests / Go tests (push) Successful in 42s
Create distribution / Release (push) Successful in 1m0s
Nix / NixOS tests (push) Successful in 3m53s
This release mostly fixes bugs uncovered when running fortify on a generic linux distribution.
Signed-off-by: Ophestra <cat@gensokyo.uk >
2024-12-29 01:09:47 +09:00
c109ac2653
release: 0.2.7
...
Tests / Go tests (push) Successful in 47s
Create distribution / Release (push) Successful in 1m5s
Nix / NixOS tests (push) Successful in 4m40s
Signed-off-by: Ophestra <cat@gensokyo.uk >
2024-12-22 13:34:50 +09:00
5c73acb56f
release: 0.2.6
...
Tests / Go tests (push) Successful in 48s
Create distribution / Release (push) Successful in 1m12s
Nix / NixOS tests (push) Successful in 3m59s
Signed-off-by: Ophestra <cat@gensokyo.uk >
2024-12-22 01:18:21 +09:00
ed8ee5eb4b
nix: filter nix files from src
...
Tests / Go tests (push) Successful in 38s
Nix / NixOS tests (push) Successful in 3m7s
This prevents constant rebuilds when debugging integration tests.
Signed-off-by: Ophestra <cat@gensokyo.uk >
2024-12-21 17:39:42 +09:00
195b717e01
release: 0.2.5
...
Tests / Go tests (push) Successful in 49s
Create distribution / Release (push) Successful in 1m6s
Nix / NixOS tests (push) Successful in 1m23s
Signed-off-by: Ophestra Umiker <cat@ophivana.moe >
2024-12-20 00:28:48 +09:00
df6fc298f6
migrate to git.gensokyo.uk/security/fortify
...
Tests / Go tests (push) Successful in 2m55s
Nix / NixOS tests (push) Successful in 5m10s
Signed-off-by: Ophestra Umiker <cat@ophivana.moe >
2024-12-20 00:20:02 +09:00
9f95f60400
release: 0.2.4
...
Tests / Go tests (push) Successful in 52s
Create distribution / Release (push) Successful in 1m9s
Nix / NixOS tests (push) Successful in 1m23s
Signed-off-by: Ophestra Umiker <cat@ophivana.moe >
2024-12-18 23:52:52 +09:00
38653c6ab5
release: 0.2.3
...
Tests / Go tests (push) Successful in 55s
Create distribution / Release (push) Successful in 1m1s
Nix / NixOS tests (push) Successful in 5m5s
Signed-off-by: Ophestra Umiker <cat@ophivana.moe >
2024-12-17 14:06:17 +09:00
138666d753
nix: skip acl test
...
test / test (push) Successful in 39s
The nix build environment does not support ACLs.
Signed-off-by: Ophestra Umiker <cat@ophivana.moe >
2024-12-16 19:29:01 +09:00
e3f1d7ba60
release: 0.2.2
...
release / release (push) Successful in 44s
test / test (push) Successful in 35s
Signed-off-by: Ophestra Umiker <cat@ophivana.moe >
2024-12-07 21:47:22 +09:00
2d606b1f4b
wl: implement security-context-v1
...
test / test (push) Successful in 38s
Signed-off-by: Ophestra Umiker <cat@ophivana.moe >
2024-12-06 04:15:13 +09:00
30b8bce90a
fortify: zsh completion
...
test / test (push) Successful in 22s
Signed-off-by: Ophestra Umiker <cat@ophivana.moe >
2024-11-20 01:25:19 +09:00
de0d78daae
release: 0.2.1
...
release / release (push) Successful in 1m4s
test / test (push) Successful in 20s
Signed-off-by: Ophestra Umiker <cat@ophivana.moe >
2024-11-19 21:03:50 +09:00
d99c8b1fb4
release: 0.2.0
...
release / release (push) Successful in 44s
test / test (push) Successful in 22s
Signed-off-by: Ophestra Umiker <cat@ophivana.moe >
2024-11-19 18:15:09 +09:00
748a0ae2c8
nix: wrap program from libexec
...
test / test (push) Successful in 24s
This avoids renaming the fortify binary.
Signed-off-by: Ophestra Umiker <cat@ophivana.moe >
2024-11-18 12:58:47 +09:00
6a6d30af1f
cmd/fuserdb: systemd userdb drop-in entries generator
...
test / test (push) Successful in 20s
This provides user records via nss-systemd. Static drop-in entries are generated to reduce complexity and attack surface.
Signed-off-by: Ophestra Umiker <cat@ophivana.moe >
2024-11-17 02:16:02 +09:00
df33123bd7
app: integrate fsu
...
test / test (push) Successful in 21s
This removes the dependency on external user switchers like sudo/machinectl and decouples fortify user ids from the passwd database.
Signed-off-by: Ophestra Umiker <cat@ophivana.moe >
2024-11-16 21:19:45 +09:00
3962705126
nix: keep fshim and finit names
...
test / test (push) Successful in 22s
Signed-off-by: Ophestra Umiker <cat@ophivana.moe >
2024-11-06 14:59:28 +09:00
f831948bca
release: 0.1.0
...
release / release (push) Successful in 28s
test / test (push) Successful in 21s
This release significantly changes the command line interface, and updates the NixOS module to finally produce meaningful sandbox configuration.
Signed-off-by: Ophestra Umiker <cat@ophivana.moe >
2024-11-06 04:37:43 +09:00
cfd05b10f1
release: 0.0.11
...
release / release (push) Successful in 28s
test / test (push) Successful in 19s
This will be the final release before major command line interface changes. This version is tagged as it contains many fixes that still impacts the permissive defaults usage pattern.
Signed-off-by: Ophestra Umiker <cat@ophivana.moe >
2024-11-04 13:46:47 +09:00
88abcbe0b2
cmd/fsu: remove import of internal package
...
test / test (push) Successful in 24s
Signed-off-by: Ophestra Umiker <cat@ophivana.moe >
2024-11-04 12:32:14 +09:00
584732f80a
cmd: shim and init into separate binaries
...
test / test (push) Successful in 19s
This change also fixes a deadlock when shim fails to connect and complete the setup.
Signed-off-by: Ophestra Umiker <cat@ophivana.moe >
2024-11-02 03:13:57 +09:00
563c39c2d9
release: 0.0.10
...
release / release (push) Successful in 24s
test / test (push) Successful in 19s
Signed-off-by: Ophestra Umiker <cat@ophivana.moe >
2024-10-28 20:38:10 +09:00
aa1f96eeeb
fsu: check parent executable path
...
test / test (push) Successful in 19s
Only allow main program to launch fsu. This change and further checks in the main program reduces attack surface.
Signed-off-by: Ophestra Umiker <cat@ophivana.moe >
2024-10-28 18:52:23 +09:00
d9cb2a9f2b
fsu: implement simple setuid user switcher
...
Contains path to fortify, set at compile time, authenticates based on a simple uid range assignment file which also acts as the allow list.
Signed-off-by: Ophestra Umiker <cat@ophivana.moe >
2024-10-28 00:02:34 +09:00
6d8bcb63f2
release: 0.0.9
...
release / release (push) Successful in 27s
test / test (push) Successful in 22s
Signed-off-by: Ophestra Umiker <cat@ophivana.moe >
2024-10-27 01:25:24 +09:00
2f34627d37
release: 0.0.8
...
release / release (push) Successful in 31s
test / test (push) Successful in 20s
Signed-off-by: Ophestra Umiker <cat@ophivana.moe >
2024-10-27 00:49:50 +09:00
133f23e0de
release: 0.0.7
...
release / release (push) Successful in 21s
test / test (push) Successful in 11s
Signed-off-by: Ophestra Umiker <cat@ophivana.moe >
2024-10-20 19:50:59 +09:00
ecce832d93
release: 0.0.6
...
release / release (push) Successful in 1m46s
test / test (push) Successful in 1m39s
Signed-off-by: Ophestra Umiker <cat@ophivana.moe >
2024-10-18 01:26:42 +09:00
4ebb98649e
release: 0.0.5
...
release / release (push) Successful in 1m26s
test / test (push) Successful in 3m6s
Signed-off-by: Ophestra Umiker <cat@ophivana.moe >
2024-10-17 20:48:41 +09:00
689f5bed57
release: 0.0.4
...
release / release (push) Successful in 1m32s
Signed-off-by: Ophestra Umiker <cat@ophivana.moe >
2024-10-15 02:56:49 +09:00
41a7eb567e
release: 0.0.3
...
release / release (push) Successful in 2m38s
Signed-off-by: Ophestra Umiker <cat@ophivana.moe >
2024-10-14 02:31:11 +09:00
f4c44a9441
release: 0.0.2
...
release / release (push) Successful in 2m15s
Signed-off-by: Ophestra Umiker <cat@ophivana.moe >
2024-10-10 00:13:06 +09:00
22dfa73efe
release: 0.0.1
...
release / release (push) Successful in 1m51s
Signed-off-by: Ophestra Umiker <cat@ophivana.moe >
2024-10-09 20:48:38 +09:00
996bf67ac2
release: 0.0.0-beta.5
...
Signed-off-by: Ophestra Umiker <cat@ophivana.moe >
2024-09-28 00:25:16 +09:00
a75229991c
nix: make bubblewrap available in PATH
...
Signed-off-by: Ophestra Umiker <cat@ophivana.moe >
2024-09-23 18:21:12 +09:00
9a9fcdb9ec
release: 0.0.0-beta.4
...
Signed-off-by: Ophestra Umiker <cat@ophivana.moe >
2024-09-22 01:18:47 +09:00
2763ec730e
release: 0.0.0-beta.3
...
Signed-off-by: Ophestra Umiker <cat@ophivana.moe >
2024-09-17 23:17:39 +09:00
6a6f62efa6
release: 0.0.0-beta.2
...
This project started as a Go implementation of https://github.com/intgr/ego . That is clearly no longer what it is anymore and the tagged releases no longer made sense, so we're going back to v0.
Signed-off-by: Ophestra Umiker <cat@ophivana.moe >
2024-09-16 20:41:02 +09:00
c1bfe2cd74
release: 1.1.0
...
Signed-off-by: Ophestra Umiker <cat@ophivana.moe >
2024-09-09 05:14:53 +09:00
cdc08817a7
nix: add xdg-dbus-proxy to PATH via wrapProgram
...
Signed-off-by: Ophestra Umiker <cat@ophivana.moe >
2024-09-09 04:37:12 +09:00
58d3a1fbc7
release: 1.0.4
...
Signed-off-by: Ophestra Umiker <cat@ophivana.moe >
2024-09-04 19:57:47 +09:00
