mirror of
https://github.com/CyberMind-FR/secubox-deb.git
synced 2026-07-28 21:17:36 +00:00
62e8631f2b
* docs: spec — Sentinel C2/botnet auto-learning (high-precision, report-only) (ref #823) * docs: implementation plan — Sentinel C2/botnet auto-learning (ref #823) * feat(sentinel): C2 autolearn false-positive allowlist gate (ref #826) * fix(sentinel): serialize c2allow Add + robust atomicWriteFile (relative-path + temp cleanup) (ref #826) * feat(sentinel): C2 autolearn corroborating signals (rare/non-browser-JA/DGA) (ref #826) * feat(sentinel): C2 autolearn candidate lifecycle + persistence (ref #826) * fix(sentinel): c2cand deep-copy snapshots (persist/snapshot/record race) + evict order + device cap (ref #826) * feat(sentinel): C2 autolearn orchestrator — learned set + report-only verdicts (ref #826) * feat(sentinel): wire C2 learner into daemon + /c2 endpoints + seeded allowlist (ref #826) * fix(sentinel): make /c2/allow writable in packaged deploy (RW path + ownership) + sanitize Add (ref #826) POST /c2/allow could never write in production: sbx-sentinel.service runs User=secubox-toolbox under ProtectSystem=strict + ReadOnlyPaths=/etc/secubox, and the seeded c2-allow.txt ships root:root. Fix both halves: nest ReadWritePaths=/etc/secubox/sentinel under the existing ReadOnlyPaths=/etc/secubox in the unit, and chown/chmod 0750 the sentinel/ subdir + file (never the shared /etc/secubox parent) in postinst's configure branch, fail-safe. Also: fix the /c2/allow doc comment (form/query only, not JSON — r.FormValue never parses a body), and sanitize C2Allow.Add against newline injection now that host is network-reachable. * feat(toolbox): WebUI C2 appris sub-view + Ignorer allowlist proxy (ref #826) * fix(toolbox): C2 view XSS (data-host not onclick) + normalize candidate signal maps (ref #826) * fix(sentinel): bound c2 beaconing/learned maps + drop promoted from candidates + reject bare-TLD allow (ref #826) --------- Co-authored-by: CyberMind-FR <gandalf@Gk2.net>
81 lines
4.4 KiB
Makefile
Executable File
81 lines
4.4 KiB
Makefile
Executable File
#!/usr/bin/make -f
|
|
# SPDX-License-Identifier: LicenseRef-CMSD-1.0
|
|
# SecuBox-Deb :: toolbox-ng — Go MITM engine (migration target, DARK)
|
|
#
|
|
# #662 added the FIRST external modules (uTLS Chrome upstream + brotli/zstd
|
|
# inject). They are VENDORED into ./vendor and committed, so the binary STILL
|
|
# cross-compiles fully offline (GOPROXY=off, -mod=vendor — no network, no module
|
|
# download). All deps are pure-Go: CGO_ENABLED=0 holds. GOTOOLCHAIN=local pins
|
|
# the build to the distro Go so an offline sandbox never tries to fetch a newer
|
|
# toolchain. CI cross-builds for arm64; this rules file does the same.
|
|
|
|
export DH_VERBOSE = 1
|
|
|
|
# Build the static arm64 binary offline from the committed vendor/ tree.
|
|
export GOOS = linux
|
|
export GOARCH = arm64
|
|
export CGO_ENABLED = 0
|
|
export GOFLAGS = -mod=vendor
|
|
export GOPROXY = off
|
|
export GOTOOLCHAIN = local
|
|
# Keep the Go build/module cache inside the build tree (sandbox-friendly).
|
|
export GOCACHE = $(CURDIR)/_gocache
|
|
export GOPATH = $(CURDIR)/_gopath
|
|
|
|
%:
|
|
dh $@
|
|
|
|
override_dh_auto_build:
|
|
go build -trimpath -ldflags=-s -o sbxmitm ./cmd/sbxmitm
|
|
# #823 Sentinel async analyzer daemon. DEFAULT build is cgo-free (YARA stub);
|
|
# a YARA-enabled build is the explicit `-tags yara` variant against
|
|
# libyara-dev (see debian/README.sentinel.md) — NOT the default .deb.
|
|
go build -trimpath -ldflags=-s -o sbx-sentinel ./cmd/sbx-sentinel
|
|
|
|
# No Go unit tests at package-build time (run in CI on the host arch; the
|
|
# arm64 cross-binary cannot execute its tests here).
|
|
override_dh_auto_test:
|
|
|
|
override_dh_auto_install:
|
|
install -d debian/secubox-toolbox-ng/usr/sbin
|
|
install -m 0755 sbxmitm debian/secubox-toolbox-ng/usr/sbin/sbxmitm
|
|
# #823 Sentinel: the async analyzer daemon + the fail-safe feed fetcher.
|
|
install -m 0755 sbx-sentinel debian/secubox-toolbox-ng/usr/sbin/sbx-sentinel
|
|
install -m 0755 sbin/secubox-sentinel-feeds debian/secubox-toolbox-ng/usr/sbin/secubox-sentinel-feeds
|
|
# #823 Sentinel: shipped base IOC/YARA content pack (read-only content).
|
|
install -d debian/secubox-toolbox-ng/usr/share/secubox/sentinel/packs/base
|
|
install -m 0644 packs/base/*.json debian/secubox-toolbox-ng/usr/share/secubox/sentinel/packs/base/
|
|
install -m 0644 packs/base/README.md debian/secubox-toolbox-ng/usr/share/secubox/sentinel/packs/base/
|
|
# #823 Sentinel: shared SENTINEL_* config (dpkg conffile under /etc).
|
|
install -d debian/secubox-toolbox-ng/etc/secubox
|
|
install -m 0644 debian/sentinel.env debian/secubox-toolbox-ng/etc/secubox/sentinel.env
|
|
# #826 C2 auto-learn: seeded operator allowlist (dpkg conffile) + the
|
|
# shipped browser-JA4 corroborating-signal seed (read-only content).
|
|
install -d debian/secubox-toolbox-ng/etc/secubox/sentinel
|
|
install -m 0644 debian/c2-allow.txt debian/secubox-toolbox-ng/etc/secubox/sentinel/c2-allow.txt
|
|
install -m 0644 debian/browser-ja4.txt debian/secubox-toolbox-ng/usr/share/secubox/sentinel/browser-ja4.txt
|
|
# #736 media catcher: own its /run log so the append never fails (see conf)
|
|
install -d debian/secubox-toolbox-ng/usr/lib/tmpfiles.d
|
|
install -m 0644 tmpfiles/zz-secubox-toolbox-ng.conf debian/secubox-toolbox-ng/usr/lib/tmpfiles.d/
|
|
# #812 R4 media buffer: pre-create /data/secubox/media-buffer (0750) so the
|
|
# feature works the moment an operator flips --media-buffer on, no manual step
|
|
install -m 0644 tmpfiles/zz-secubox-media-buffer.conf debian/secubox-toolbox-ng/usr/lib/tmpfiles.d/
|
|
# #823 Sentinel: pre-create the verdict-store + overlay dirs (0750 secubox-toolbox)
|
|
install -m 0644 tmpfiles/zz-secubox-sentinel.conf debian/secubox-toolbox-ng/usr/lib/tmpfiles.d/
|
|
|
|
override_dh_auto_clean:
|
|
rm -f sbxmitm sbx-sentinel
|
|
rm -rf _gocache _gopath
|
|
|
|
# DARK: install the unit files into the catalogue but DO NOT enable or start
|
|
# them. This is the Phase-6 cutover target; the live R3 tunnel stays on the
|
|
# Python workers until the operator enables everything manually. The postinst
|
|
# still reloads the unit catalogue so `systemctl` knows the units exist.
|
|
# - worker@ : the Go MITM fanout (#662)
|
|
# - sbx-sentinel + secubox-sentinel-feeds{.service,.timer} : the #823 engine
|
|
override_dh_installsystemd:
|
|
dh_installsystemd --no-enable --no-start --name=secubox-toolbox-ng-worker@
|
|
dh_installsystemd --no-enable --no-start --name=sbx-sentinel sbx-sentinel.service
|
|
dh_installsystemd --no-enable --no-start --name=secubox-sentinel-feeds secubox-sentinel-feeds.service
|
|
dh_installsystemd --no-enable --no-start --name=secubox-sentinel-feeds secubox-sentinel-feeds.timer
|