aboutsummaryrefslogtreecommitdiffhomepage
path: root/package.nix
AgeCommit message (Collapse)Author
2025-01-20proc/priv/shim: seccomp bpf filter via libseccompOphestra
Rulesets adapted from Flatpak for compatibility. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-01-18release: 0.2.10Ophestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-01-18proc: remove duplicate compile-time fortify referenceOphestra
This is no longer needed since shim and init are now part of the main program. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-01-18proc/priv/init: merge init into main programOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-01-17proc/priv/shim: merge shim into main programOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-01-17nix: do not force static linking on nixOphestra
In a typical Nix or NixOS-based setup, the entire /nix/store directory is available to the sandbox. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-01-16fortify: switch to static linkingOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-01-15release: 0.2.9Ophestra
This release mostly contains permissive defaults fixes and optimisations. It also contains a proof of concept version of fpkg. Signed-off-by: Ophestra <cat@gensokyo.uk>
2024-12-26internal: include path to fortify main programOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2024-12-29release: 0.2.8Ophestra
This release mostly fixes bugs uncovered when running fortify on a generic linux distribution. Signed-off-by: Ophestra <cat@gensokyo.uk>
2024-12-22release: 0.2.7Ophestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2024-12-22release: 0.2.6Ophestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2024-12-21nix: filter nix files from srcOphestra
This prevents constant rebuilds when debugging integration tests. Signed-off-by: Ophestra <cat@gensokyo.uk>
2024-12-20release: 0.2.5Ophestra Umiker
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
2024-12-20migrate to git.gensokyo.uk/security/fortifyOphestra Umiker
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
2024-12-18release: 0.2.4Ophestra Umiker
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
2024-12-17release: 0.2.3Ophestra Umiker
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
2024-12-16nix: skip acl testOphestra Umiker
The nix build environment does not support ACLs. Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
2024-12-07release: 0.2.2Ophestra Umiker
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
2024-12-06wl: implement security-context-v1Ophestra Umiker
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
2024-11-20fortify: zsh completionOphestra Umiker
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
2024-11-19release: 0.2.1Ophestra Umiker
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
2024-11-19release: 0.2.0Ophestra Umiker
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
2024-11-18nix: wrap program from libexecOphestra Umiker
This avoids renaming the fortify binary. Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
2024-11-17cmd/fuserdb: systemd userdb drop-in entries generatorOphestra Umiker
This provides user records via nss-systemd. Static drop-in entries are generated to reduce complexity and attack surface. Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
2024-11-16app: integrate fsuOphestra Umiker
This removes the dependency on external user switchers like sudo/machinectl and decouples fortify user ids from the passwd database. Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
2024-11-06nix: keep fshim and finit namesOphestra Umiker
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
2024-11-06release: 0.1.0Ophestra Umiker
This release significantly changes the command line interface, and updates the NixOS module to finally produce meaningful sandbox configuration. Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
2024-11-04release: 0.0.11Ophestra Umiker
This will be the final release before major command line interface changes. This version is tagged as it contains many fixes that still impacts the permissive defaults usage pattern. Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
2024-11-04cmd/fsu: remove import of internal packageOphestra Umiker
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
2024-11-02cmd: shim and init into separate binariesOphestra Umiker
This change also fixes a deadlock when shim fails to connect and complete the setup. Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
2024-10-28release: 0.0.10Ophestra Umiker
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
2024-10-28fsu: check parent executable pathOphestra Umiker
Only allow main program to launch fsu. This change and further checks in the main program reduces attack surface. Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
2024-10-28fsu: implement simple setuid user switcherOphestra Umiker
Contains path to fortify, set at compile time, authenticates based on a simple uid range assignment file which also acts as the allow list. Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
2024-10-27release: 0.0.9Ophestra Umiker
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
2024-10-27release: 0.0.8Ophestra Umiker
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
2024-10-20release: 0.0.7Ophestra Umiker
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
2024-10-18release: 0.0.6Ophestra Umiker
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
2024-10-17release: 0.0.5Ophestra Umiker
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
2024-10-15release: 0.0.4Ophestra Umiker
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
2024-10-14release: 0.0.3Ophestra Umiker
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
2024-10-10release: 0.0.2Ophestra Umiker
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
2024-10-09release: 0.0.1Ophestra Umiker
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
2024-09-28release: 0.0.0-beta.5Ophestra Umiker
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
2024-09-23nix: make bubblewrap available in PATHOphestra Umiker
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
2024-09-22release: 0.0.0-beta.4Ophestra Umiker
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
2024-09-17release: 0.0.0-beta.3Ophestra Umiker
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
2024-09-16release: 0.0.0-beta.2Ophestra Umiker
This project started as a Go implementation of https://github.com/intgr/ego. That is clearly no longer what it is anymore and the tagged releases no longer made sense, so we're going back to v0. Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
2024-09-09release: 1.1.0Ophestra Umiker
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
2024-09-09nix: add xdg-dbus-proxy to PATH via wrapProgramOphestra Umiker
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
generated by cgit v1.3.1 (git 2.54.0) at 2026-09-04 14:30:07 +0000