mirror of
https://github.com/CyberMind-FR/secubox-deb.git
synced 2026-07-29 15:37:03 +00:00
CyberMind-FR
d7c8cc19e9
New modules (35 total): - secubox-repo v1.0.0: APT repository management - repoctl CLI for package management - GPG key generation and signing - Multi-distribution support (bookworm, trixie) - Web dashboard for repository status - secubox-hardening v1.0.0: Kernel and system hardening - hardeningctl CLI for security management - Sysctl hardening (ASLR, kptr_restrict, SYN cookies) - Module blacklist (uncommon protocols, filesystems) - Security benchmark with 100% score on VM CI/CD workflows: - build-packages.yml: Dynamic matrix for all packages - build-image.yml: 5 board images with compression - publish-packages.yml: APT repo publishing - release.yml: Unified release orchestration APT repository scripts: - export-secrets.sh: Export GPG/SSH keys for GitHub Actions - local-publish.sh: Local test server - install.sh: User installation script Security (Phase 5): - AppArmor profiles for all services - Audit rules for SecuBox services - build-all.sh for local builds Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
37 lines
697 B
Plaintext
37 lines
697 B
Plaintext
# AppArmor profile for secubox-wireguard
|
|
# WireGuard VPN Dashboard API
|
|
|
|
#include <tunables/global>
|
|
|
|
profile secubox-wireguard /usr/lib/secubox/wireguard/** {
|
|
#include <abstractions/base>
|
|
#include <abstractions/python>
|
|
#include <abstractions/nameservice>
|
|
|
|
# SecuBox base permissions
|
|
#include <local/secubox-base>
|
|
|
|
# WireGuard configuration
|
|
/etc/wireguard/ r,
|
|
/etc/wireguard/** rw,
|
|
|
|
# WireGuard tools
|
|
/usr/bin/wg Ux,
|
|
/usr/bin/wg-quick Ux,
|
|
|
|
# QR code generation
|
|
/usr/bin/qrencode Ux,
|
|
|
|
# Network interface info
|
|
/sys/class/net/** r,
|
|
/proc/net/** r,
|
|
|
|
# IP tools
|
|
/sbin/ip Ux,
|
|
/usr/sbin/ip Ux,
|
|
|
|
# Deny sensitive paths
|
|
deny /etc/shadow r,
|
|
deny /etc/gshadow r,
|
|
}
|