|
|
a37661d101
|
feat(macro): sudoers + AppArmor + postinst (Tor SocksPort, nft base set) (ref #771)
- sudoers.d/secubox-macro: exact NOPASSWD line, default env_reset only (no
SETENV/env_keep), validated by visudo
- apparmor/secubox-macroctl: enforce profile — python3/macros.d/nft/ip rix,
/etc/tor/torrc.d/ r, /var/lib/secubox/macro/** rw, audit.log w,
inet stream + netlink raw; DEFAULT-DENY all else
- conf/secubox-macro-tor-exit.conf.example: __MESH_IP__ token + comment
- debian/postinst: create /var/lib/secubox/macro/{active,grants} 0750
secubox, nft base set + input rule (guarded on inet secubox_filter),
sed-render Tor SocksPort torrc.d file with wg-mesh IP, apparmor_parser -r
- debian/prerm: remove torrc.d file, drop nft input rule by handle (best-effort)
- debian/rules: drop unused /etc/tor/torrc.d dir; add install -d for
usr/share/secubox/macro before conf.example install
Verification: visudo parsed OK, sh -n OK for both scripts, apparmor --preprocess
OK, 14/14 tests pass, all rules-referenced files confirmed present.
|
2026-07-01 08:20:38 +02:00 |
|
|
|
49da4093f7
|
feat(macro): scaffold secubox-macro + secubox-macroctl dispatcher (ref #771)
- New Debian package secubox-macro (0.1.0-1~bookworm1, Architecture:all)
- secubox-macroctl: root dispatcher that validates kind against macros.d
allowlist, tamper-guards plugins (world-writable check + realpath escape),
validates --src-ip within mesh CIDR, execs plugin verb via subprocess
without shell, appends audit JSON line; env overrides for tests
- TDD: 5 tests written first (rejects unknown kind, path-traversal kind,
src-ip outside mesh, dispatches+audits, world-writable refused) — all pass
- debian/control, compat=13, changelog, rules skeleton (tor-exit/sudoers/
apparmor/conf referenced but not yet created — Tasks 4-5)
|
2026-07-01 07:58:54 +02:00 |
|
