mirror of
https://github.com/CyberMind-FR/secubox-deb.git
synced 2026-07-29 09:14:33 +00:00
CyberMind-FR
d7c8cc19e9
New modules (35 total): - secubox-repo v1.0.0: APT repository management - repoctl CLI for package management - GPG key generation and signing - Multi-distribution support (bookworm, trixie) - Web dashboard for repository status - secubox-hardening v1.0.0: Kernel and system hardening - hardeningctl CLI for security management - Sysctl hardening (ASLR, kptr_restrict, SYN cookies) - Module blacklist (uncommon protocols, filesystems) - Security benchmark with 100% score on VM CI/CD workflows: - build-packages.yml: Dynamic matrix for all packages - build-image.yml: 5 board images with compression - publish-packages.yml: APT repo publishing - release.yml: Unified release orchestration APT repository scripts: - export-secrets.sh: Export GPG/SSH keys for GitHub Actions - local-publish.sh: Local test server - install.sh: User installation script Security (Phase 5): - AppArmor profiles for all services - Audit rules for SecuBox services - build-all.sh for local builds Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
41 lines
955 B
Plaintext
41 lines
955 B
Plaintext
# Generic AppArmor profile for SecuBox API services
|
|
# For services that only need basic API functionality
|
|
|
|
#include <tunables/global>
|
|
|
|
# This profile can be symlinked for simple services:
|
|
# ln -s usr.lib.secubox.generic usr.lib.secubox.netdata
|
|
# ln -s usr.lib.secubox.generic usr.lib.secubox.mediaflow
|
|
# etc.
|
|
|
|
profile secubox-generic /usr/lib/secubox/*/** {
|
|
#include <abstractions/base>
|
|
#include <abstractions/python>
|
|
#include <abstractions/nameservice>
|
|
|
|
# SecuBox base permissions
|
|
#include <local/secubox-base>
|
|
|
|
# Process info for status endpoints
|
|
/proc/ r,
|
|
/proc/[0-9]*/ r,
|
|
/proc/[0-9]*/stat r,
|
|
/proc/[0-9]*/status r,
|
|
/proc/[0-9]*/cmdline r,
|
|
|
|
# Network info
|
|
/proc/net/** r,
|
|
/sys/class/net/** r,
|
|
|
|
# Systemd status (read-only)
|
|
/run/systemd/private r,
|
|
|
|
# Deny dangerous operations
|
|
deny /root/** rwx,
|
|
deny /home/*/.ssh/** rwx,
|
|
deny /etc/shadow r,
|
|
deny /etc/gshadow r,
|
|
deny /proc/kcore r,
|
|
deny /proc/*/mem rw,
|
|
}
|