mirror of
https://github.com/CyberMind-FR/secubox-deb.git
synced 2026-07-28 21:17:36 +00:00
119 lines
6.0 KiB
Plaintext
119 lines
6.0 KiB
Plaintext
secubox-profiles (0.7.0-1~bookworm1) bookworm; urgency=medium
|
|
|
|
* apply: observed state (not command return code) arbitrates STOP/START —
|
|
non-blocking systemctl (--no-block) + best-effort lxc, wait_state is the
|
|
sole arbiter and now checks the container (lxc-info) for LXC modules.
|
|
* apply: wait_state timeout is derived per-module from systemd
|
|
TimeoutStop/StartUSec (margin-added, safety-capped), replacing the flat 30s.
|
|
* _run distinguishes a command timeout (still working, deferred) from a
|
|
could-not-run (hard fail).
|
|
* web: /apply reverts the `active` pointer when the ctl rolls back.
|
|
* Fixes the spurious mass-apply rollback (ref #893).
|
|
|
|
-- Gerald KERMA <devel@cybermind.fr> Mon, 20 Jul 2026 09:13:20 +0200
|
|
|
|
secubox-profiles (0.6.2-1~bookworm1) bookworm; urgency=medium
|
|
|
|
* Fix apply on condition-gated modules: a unit whose systemd start-condition
|
|
fails (e.g. hexo — ConditionResult=no) can never become active, so `enable
|
|
--now` succeeds but wait_state timed out → the whole apply spuriously
|
|
rolled back. Now a START of a condition-failed native unit is treated as
|
|
reached (the module is deliberately off in this environment), not a failure.
|
|
|
|
-- Gerald KERMA <devel@cybermind.fr> Sun, 19 Jul 2026 14:00:00 +0200
|
|
|
|
secubox-profiles (0.6.1-1~bookworm1) bookworm; urgency=medium
|
|
|
|
* Fix apply/rollback from the panel: the service runs ProtectSystem=strict, so a
|
|
sudo child inherited the read-only mount namespace (EROFS on the snapshot dir).
|
|
The panel now delegates via `systemd-run --wait --pipe` so the root CLI runs in
|
|
PID 1's context, OUTSIDE the sandbox, able to write snapshot/audit/routes and
|
|
drive systemd/LXC. Sudoers grants updated to the systemd-run-wrapped commands.
|
|
|
|
-- Gerald KERMA <devel@cybermind.fr> Sun, 19 Jul 2026 13:00:00 +0200
|
|
|
|
secubox-profiles (0.6.0-1~bookworm1) bookworm; urgency=medium
|
|
|
|
* Task 3: apply/rollback API + panel now sudo -> secubox-profilectl
|
|
(webui->ctl). Unit sets NoNewPrivileges=false (was true, which
|
|
neutralized sudo) — the rest of the hardening (User=secubox,
|
|
restricted ReadWritePaths) is unchanged. Ships a scoped, exact-command
|
|
sudoers drop-in (/etc/sudoers.d/secubox-profiles) granting only
|
|
`secubox-profilectl apply --yes --json` and
|
|
`secubox-profilectl rollback --yes --json`, matching the fixed argv
|
|
api/web.py's _run_ctl_json builds — no wildcards.
|
|
|
|
-- Gerald KERMA <devel@cybermind.fr> Sun, 19 Jul 2026 13:00:00 +0200
|
|
|
|
secubox-profiles (0.5.0-1~bookworm1) bookworm; urgency=medium
|
|
|
|
* Phase 2: Requires=secubox-core.service -> Wants= on this module's unit
|
|
(remove the hard cascade-stop when secubox-core restarts/fails).
|
|
|
|
-- Gerald KERMA <devel@cybermind.fr> Sun, 19 Jul 2026 12:00:00 +0200
|
|
|
|
secubox-profiles (0.4.1-1~bookworm1) bookworm; urgency=medium
|
|
|
|
* Fix LXC autostart actuation (found in lyrion board validation): lxc.start.auto
|
|
is now set by EDITING the container config file at <lxcpath>/<name>/config
|
|
(lxcpath from `lxc-config lxc.lxcpath` = /data/lxc on gk2) — the previous
|
|
`lxc-update-config -n -x` is not a config-set tool and failed rc=1, leaving a
|
|
module partly stopped. Also: set autostart=0 BEFORE lxc-stop so secubox-watchdog
|
|
does not revive the container mid-stop.
|
|
|
|
-- Gerald KERMA <devel@cybermind.fr> Sun, 19 Jul 2026 11:00:00 +0200
|
|
|
|
secubox-profiles (0.4.0-1~bookworm1) bookworm; urgency=medium
|
|
|
|
* Phase 3a: apply actuator. `secubox-profilectl apply [--profile X] [--only ID]
|
|
[--yes]` (dry-run by default) and `rollback [--target R1..R4] [--yes]` — root
|
|
only. Actuates systemd/LXC/portal one module at a time (stops before starts),
|
|
waits for state, snapshots pre-state (4R, with portal route values), audits
|
|
each decision, and rolls back on any failure. Boot reconciliation and the
|
|
API/panel surfaces come in a follow-up.
|
|
|
|
-- Gerald KERMA <devel@cybermind.fr> Sun, 19 Jul 2026 16:00:00 +0200
|
|
|
|
secubox-profiles (0.3.0-1~bookworm1) bookworm; urgency=medium
|
|
|
|
* Ship four functional profile tiers: full, lite, secure-gateway, media-lab
|
|
(seeded into /etc/secubox/profiles on install, never overwriting edits).
|
|
* New read-only CLI: secubox-profilectl export <profile> [--format
|
|
pkglist|apt|json] — the Debian package list of a profile's active modules,
|
|
for building a slim installer/image. Unresolved modules are surfaced, never
|
|
silently dropped.
|
|
|
|
-- Gerald KERMA <devel@cybermind.fr> Fri, 18 Jul 2026 12:00:00 +0200
|
|
|
|
secubox-profiles (0.2.1-1~bookworm1) bookworm; urgency=medium
|
|
|
|
* perf : /status batché — une seule commande `systemctl show` pour toutes
|
|
les units natives + une seule énumération `lxc-ls -f`, au lieu de 3
|
|
sous-process par module (observe.observe_all, mesuré 46s -> <1s sur 187
|
|
modules). Cache TTL 60s hors-loop (asyncio.to_thread) côté API, avec
|
|
rafraîchissement en arrière-plan ; cache froid = calcul direct, jamais
|
|
d'erreur. /status expose désormais `cached_at`/`age_s`.
|
|
* observe() module par module reste la référence ; observe_all() est le
|
|
chemin rapide, pas un remplacement — unit/conteneur absent du batch
|
|
reste enabled/active/lxc_running/lxc_autostart=None (jamais un False
|
|
fabriqué), y compris pour les units *@.service (templates) qui feraient
|
|
échouer tout le batch si elles y entraient.
|
|
|
|
-- Gerald KERMA <devel@cybermind.fr> Fri, 17 Jul 2026 12:00:00 +0200
|
|
|
|
secubox-profiles (0.2.0-1~bookworm1) bookworm; urgency=medium
|
|
|
|
* webui : API web (socket dédié /run/secubox/profiles.sock, service propre,
|
|
jamais servi par l'aggregator) + panel /profiles/ (hybrid-dark).
|
|
* status/profiles/pins/diff en lecture ; écriture limitée aux membres de
|
|
profil et aux pins (jamais d'apply — Phase 3). Pin protégé->off refusé
|
|
en HTTP 409 avant toute écriture disque.
|
|
|
|
-- Gerald KERMA <devel@cybermind.fr> Fri, 17 Jul 2026 12:00:00 +0200
|
|
|
|
secubox-profiles (0.1.0-1~bookworm1) bookworm; urgency=medium
|
|
|
|
* Phase 1 : manifestes, profiler scan, status, diff (lecture seule).
|
|
|
|
-- Gerald KERMA <devel@cybermind.fr> Fri, 17 Jul 2026 12:00:00 +0200
|