mirror of
https://github.com/CyberMind-FR/secubox-deb.git
synced 2026-07-28 21:17:36 +00:00
CyberMind-FR
bd8e2e382e
Some checks failed
License Headers / check (push) Has been cancelled
The board ran a hand-created unhardened ROOT sbxwaf on :8085 while the package shipped only a worker@ fan-out that crash-looped (panic on the root-only cookie-audit log) and, as secubox-waf + RuntimeDirectory=secubox, re-chowned the shared /run/secubox on every crash-restart — breaking every secubox-user socket bind (profiles 502s). Ship ONE hardened unit (secubox-waf-ng.service, :8085, User=secubox-waf, full sandbox, NO RuntimeDirectory — sbxwaf only connects to waker.sock). postinst asserts the perms a non-root sbxwaf needs (haproxy-routes.json 0644, cookie-audit ledger writable by secubox-waf), disables leftover worker@ units, drops the /etc override. Validated live on gk2: 264 routes, real routing, admin/gitea/billets/yacy 200; a WAF restart no longer touches /run/secubox and profiles stays up. Co-Authored-By: Gerald KERMA <devel@cybermind.fr> |
||
|---|---|---|
| .. | ||
| source | ||
| changelog | ||
| control | ||
| postinst | ||
| prerm | ||
| rules | ||
| secubox-waf-ng.apparmor | ||