mirror of
https://github.com/CyberMind-FR/secubox-deb.git
synced 2026-07-28 21:17:36 +00:00
CyberMind-FR
bd8e2e382e
Some checks failed
License Headers / check (push) Has been cancelled
The board ran a hand-created unhardened ROOT sbxwaf on :8085 while the package shipped only a worker@ fan-out that crash-looped (panic on the root-only cookie-audit log) and, as secubox-waf + RuntimeDirectory=secubox, re-chowned the shared /run/secubox on every crash-restart — breaking every secubox-user socket bind (profiles 502s). Ship ONE hardened unit (secubox-waf-ng.service, :8085, User=secubox-waf, full sandbox, NO RuntimeDirectory — sbxwaf only connects to waker.sock). postinst asserts the perms a non-root sbxwaf needs (haproxy-routes.json 0644, cookie-audit ledger writable by secubox-waf), disables leftover worker@ units, drops the /etc override. Validated live on gk2: 264 routes, real routing, admin/gitea/billets/yacy 200; a WAF restart no longer touches /run/secubox and profiles stays up. Co-Authored-By: Gerald KERMA <devel@cybermind.fr>
71 lines
2.8 KiB
Makefile
Executable File
71 lines
2.8 KiB
Makefile
Executable File
#!/usr/bin/make -f
|
|
# SPDX-License-Identifier: LicenseRef-CMSD-1.0
|
|
# SecuBox-Deb :: secubox-waf-ng — Go WAF reverse-proxy (#744)
|
|
#
|
|
# Builds the static arm64 binary offline from the committed vendor/ tree in
|
|
# packages/secubox-toolbox-ng (same Go module, same vendor). The rules file
|
|
# sets GOFLAGS=-mod=vendor and GOPROXY=off so no network access is required.
|
|
# CGO_ENABLED=0 ensures a fully static binary (required for arm64 cross-build
|
|
# from an x86_64 host without an arm64 C toolchain).
|
|
#
|
|
# NOTE: execute_after_dh_auto_install is used (NOT override_dh_strip) to
|
|
# install the binary — override_dh_strip is only called in the binary-arch
|
|
# sequence and even there can silently no-op; execute_after_dh_auto_install
|
|
# runs reliably for Architecture: arm64 packages (#521, #fault-lesson).
|
|
|
|
export DH_VERBOSE = 1
|
|
|
|
# Cross-build: produce a static arm64 binary.
|
|
export GOOS = linux
|
|
export GOARCH = arm64
|
|
export CGO_ENABLED = 0
|
|
export GOFLAGS = -mod=vendor
|
|
export GOPROXY = off
|
|
export GOTOOLCHAIN = local
|
|
# Keep Go build/module cache inside the build tree (sandbox-friendly).
|
|
# Note: the Go sources + vendor tree live one level up in secubox-toolbox-ng/;
|
|
# the build is run from that directory (see override_dh_auto_build below).
|
|
export GOCACHE = $(CURDIR)/_gocache
|
|
export GOPATH = $(CURDIR)/_gopath
|
|
|
|
%:
|
|
dh $@
|
|
|
|
override_dh_auto_build:
|
|
# Build from the toolbox-ng Go module root (where go.mod + vendor/ live).
|
|
# The binary is produced in the package root directory for easy install.
|
|
cd $(CURDIR)/../secubox-toolbox-ng && \
|
|
go build -trimpath -ldflags=-s \
|
|
-o $(CURDIR)/sbxwaf \
|
|
./cmd/sbxwaf
|
|
|
|
# No Go unit tests at package-build time: the arm64 cross-binary cannot
|
|
# execute its tests on an x86_64 build host. Tests run in CI on the host arch.
|
|
override_dh_auto_test:
|
|
|
|
override_dh_auto_install:
|
|
# Intentionally empty: actual installation handled by
|
|
# execute_after_dh_auto_install below (see note at top of file).
|
|
|
|
override_dh_auto_clean:
|
|
rm -f $(CURDIR)/sbxwaf
|
|
rm -rf _gocache _gopath
|
|
|
|
override_dh_installsystemd:
|
|
# #896 reconcile: ship the SINGLE hardened unit (secubox-waf-ng.service,
|
|
# :8085) — it replaces the crash-looping worker@ fan-out template, which is
|
|
# NO LONGER installed (a reinstall must not resurrect the re-chown landmine;
|
|
# the postinst disables + removes any leftover worker@ units on the board).
|
|
install -d debian/secubox-waf-ng/lib/systemd/system
|
|
install -m 0644 systemd/secubox-waf-ng.service \
|
|
debian/secubox-waf-ng/lib/systemd/system/
|
|
dh_installsystemd --name=secubox-waf-ng
|
|
|
|
execute_after_dh_auto_install:
|
|
install -d debian/secubox-waf-ng/usr/sbin
|
|
install -m 0755 sbxwaf debian/secubox-waf-ng/usr/sbin/sbxwaf
|
|
# AppArmor profile → /etc/apparmor.d/usr.sbin.sbxwaf
|
|
install -d debian/secubox-waf-ng/etc/apparmor.d
|
|
install -m 0644 debian/secubox-waf-ng.apparmor \
|
|
debian/secubox-waf-ng/etc/apparmor.d/usr.sbin.sbxwaf
|