mirror of
https://github.com/CyberMind-FR/secubox-deb.git
synced 2026-07-30 00:19:30 +00:00
CyberMind-FR
d7c8cc19e9
New modules (35 total): - secubox-repo v1.0.0: APT repository management - repoctl CLI for package management - GPG key generation and signing - Multi-distribution support (bookworm, trixie) - Web dashboard for repository status - secubox-hardening v1.0.0: Kernel and system hardening - hardeningctl CLI for security management - Sysctl hardening (ASLR, kptr_restrict, SYN cookies) - Module blacklist (uncommon protocols, filesystems) - Security benchmark with 100% score on VM CI/CD workflows: - build-packages.yml: Dynamic matrix for all packages - build-image.yml: 5 board images with compression - publish-packages.yml: APT repo publishing - release.yml: Unified release orchestration APT repository scripts: - export-secrets.sh: Export GPG/SSH keys for GitHub Actions - local-publish.sh: Local test server - install.sh: User installation script Security (Phase 5): - AppArmor profiles for all services - Audit rules for SecuBox services - build-all.sh for local builds Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
40 lines
778 B
Plaintext
40 lines
778 B
Plaintext
# AppArmor profile for secubox-crowdsec
|
|
# CrowdSec Dashboard API
|
|
|
|
#include <tunables/global>
|
|
|
|
profile secubox-crowdsec /usr/lib/secubox/crowdsec/** {
|
|
#include <abstractions/base>
|
|
#include <abstractions/python>
|
|
#include <abstractions/nameservice>
|
|
|
|
# SecuBox base permissions
|
|
#include <local/secubox-base>
|
|
|
|
# CrowdSec CLI
|
|
/usr/bin/cscli Ux,
|
|
|
|
# CrowdSec configuration
|
|
/etc/crowdsec/ r,
|
|
/etc/crowdsec/** r,
|
|
|
|
# CrowdSec data
|
|
/var/lib/crowdsec/ r,
|
|
/var/lib/crowdsec/** r,
|
|
|
|
# CrowdSec logs
|
|
/var/log/crowdsec/ r,
|
|
/var/log/crowdsec/** r,
|
|
|
|
# CrowdSec API socket
|
|
/run/crowdsec.sock rw,
|
|
|
|
# Systemd for service control
|
|
/run/systemd/private rw,
|
|
/run/dbus/system_bus_socket rw,
|
|
|
|
# Deny sensitive paths
|
|
deny /etc/shadow r,
|
|
deny /etc/gshadow r,
|
|
}
|