aboutsummaryrefslogtreecommitdiffhomepage
path: root/package.nix
AgeCommit message (Collapse)Author
2025-03-23nix: filter test from sourceOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-17nix: clean up flake outputsOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-14ldd: run in native sandboxOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-13sandbox: native container toolingOphestra
This should eventually replace bwrap. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-02-28nix: increase nixfmt max widthOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-02-26cmd/fpkg: call app in-processOphestra
Wrapping fortify is slow, painful and error-prone. Start apps in-process instead. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-02-26nix: wrap fpkgOphestra
This is usable on nixos now due to the static build. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-02-26internal: store fortify path in internalOphestra
This now makes more sense due to the changes in build system. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-02-24nix: exclude files ending in ".py"Ophestra
This reduces rebuilds when debugging nixos tests. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-02-23release: 0.2.18Ophestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-02-23nix: separate fsu from packageOphestra
This appears to be the only way to build them with different configuration. This enables static linking in the main package. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-02-23release: 0.2.17Ophestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-02-19release: 0.2.16Ophestra
Mostly refactor and cleanup, but also contains major fix to process lifecycle management. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-02-17release: 0.2.15Ophestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-02-15release: 0.2.14Ophestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-02-13release: 0.2.13Ophestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-01-25release: 0.2.12Ophestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-01-23release: 0.2.11Ophestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-01-20proc/priv/shim: seccomp bpf filter via libseccompOphestra
Rulesets adapted from Flatpak for compatibility. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-01-18release: 0.2.10Ophestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-01-18proc: remove duplicate compile-time fortify referenceOphestra
This is no longer needed since shim and init are now part of the main program. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-01-18proc/priv/init: merge init into main programOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-01-17proc/priv/shim: merge shim into main programOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-01-17nix: do not force static linking on nixOphestra
In a typical Nix or NixOS-based setup, the entire /nix/store directory is available to the sandbox. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-01-16fortify: switch to static linkingOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-01-15release: 0.2.9Ophestra
This release mostly contains permissive defaults fixes and optimisations. It also contains a proof of concept version of fpkg. Signed-off-by: Ophestra <cat@gensokyo.uk>
2024-12-26internal: include path to fortify main programOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2024-12-29release: 0.2.8Ophestra
This release mostly fixes bugs uncovered when running fortify on a generic linux distribution. Signed-off-by: Ophestra <cat@gensokyo.uk>
2024-12-22release: 0.2.7Ophestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2024-12-22release: 0.2.6Ophestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2024-12-21nix: filter nix files from srcOphestra
This prevents constant rebuilds when debugging integration tests. Signed-off-by: Ophestra <cat@gensokyo.uk>
2024-12-20release: 0.2.5Ophestra Umiker
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
2024-12-20migrate to git.gensokyo.uk/security/fortifyOphestra Umiker
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
2024-12-18release: 0.2.4Ophestra Umiker
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
2024-12-17release: 0.2.3Ophestra Umiker
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
2024-12-16nix: skip acl testOphestra Umiker
The nix build environment does not support ACLs. Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
2024-12-07release: 0.2.2Ophestra Umiker
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
2024-12-06wl: implement security-context-v1Ophestra Umiker
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
2024-11-20fortify: zsh completionOphestra Umiker
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
2024-11-19release: 0.2.1Ophestra Umiker
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
2024-11-19release: 0.2.0Ophestra Umiker
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
2024-11-18nix: wrap program from libexecOphestra Umiker
This avoids renaming the fortify binary. Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
2024-11-17cmd/fuserdb: systemd userdb drop-in entries generatorOphestra Umiker
This provides user records via nss-systemd. Static drop-in entries are generated to reduce complexity and attack surface. Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
2024-11-16app: integrate fsuOphestra Umiker
This removes the dependency on external user switchers like sudo/machinectl and decouples fortify user ids from the passwd database. Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
2024-11-06nix: keep fshim and finit namesOphestra Umiker
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
2024-11-06release: 0.1.0Ophestra Umiker
This release significantly changes the command line interface, and updates the NixOS module to finally produce meaningful sandbox configuration. Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
2024-11-04release: 0.0.11Ophestra Umiker
This will be the final release before major command line interface changes. This version is tagged as it contains many fixes that still impacts the permissive defaults usage pattern. Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
2024-11-04cmd/fsu: remove import of internal packageOphestra Umiker
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
2024-11-02cmd: shim and init into separate binariesOphestra Umiker
This change also fixes a deadlock when shim fails to connect and complete the setup. Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
2024-10-28release: 0.0.10Ophestra Umiker
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
generated by cgit v1.3.1 (git 2.54.0) at 2026-08-30 05:02:39 +0000