mirror of
https://github.com/CyberMind-FR/secubox-deb.git
synced 2026-07-28 21:17:36 +00:00
CyberMind-FR
d7c8cc19e9
New modules (35 total): - secubox-repo v1.0.0: APT repository management - repoctl CLI for package management - GPG key generation and signing - Multi-distribution support (bookworm, trixie) - Web dashboard for repository status - secubox-hardening v1.0.0: Kernel and system hardening - hardeningctl CLI for security management - Sysctl hardening (ASLR, kptr_restrict, SYN cookies) - Module blacklist (uncommon protocols, filesystems) - Security benchmark with 100% score on VM CI/CD workflows: - build-packages.yml: Dynamic matrix for all packages - build-image.yml: 5 board images with compression - publish-packages.yml: APT repo publishing - release.yml: Unified release orchestration APT repository scripts: - export-secrets.sh: Export GPG/SSH keys for GitHub Actions - local-publish.sh: Local test server - install.sh: User installation script Security (Phase 5): - AppArmor profiles for all services - Audit rules for SecuBox services - build-all.sh for local builds Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
40 lines
834 B
Plaintext
40 lines
834 B
Plaintext
# AppArmor profile for secubox-hub
|
|
# SecuBox Hub - Central Dashboard API
|
|
|
|
#include <tunables/global>
|
|
|
|
profile secubox-hub /usr/lib/secubox/hub/** {
|
|
#include <abstractions/base>
|
|
#include <abstractions/python>
|
|
#include <abstractions/nameservice>
|
|
|
|
# SecuBox base permissions
|
|
#include <local/secubox-base>
|
|
|
|
# Hub-specific: read all module status
|
|
/run/secubox/*.sock rw,
|
|
|
|
# Menu definitions
|
|
/etc/secubox/menu.d/ r,
|
|
/etc/secubox/menu.d/** r,
|
|
|
|
# System monitoring
|
|
/proc/ r,
|
|
/proc/[0-9]*/ r,
|
|
/proc/[0-9]*/stat r,
|
|
/proc/[0-9]*/status r,
|
|
/proc/[0-9]*/cmdline r,
|
|
/proc/diskstats r,
|
|
/proc/net/** r,
|
|
|
|
# Systemd status queries
|
|
/run/systemd/private rw,
|
|
/run/dbus/system_bus_socket rw,
|
|
|
|
# Deny sensitive paths
|
|
deny /root/** rwx,
|
|
deny /home/*/.ssh/** rwx,
|
|
deny /etc/shadow r,
|
|
deny /etc/gshadow r,
|
|
}
|