mirror of
https://github.com/CyberMind-FR/secubox-deb.git
synced 2026-07-29 18:36:55 +00:00
CyberMind-FR
d7c8cc19e9
New modules (35 total): - secubox-repo v1.0.0: APT repository management - repoctl CLI for package management - GPG key generation and signing - Multi-distribution support (bookworm, trixie) - Web dashboard for repository status - secubox-hardening v1.0.0: Kernel and system hardening - hardeningctl CLI for security management - Sysctl hardening (ASLR, kptr_restrict, SYN cookies) - Module blacklist (uncommon protocols, filesystems) - Security benchmark with 100% score on VM CI/CD workflows: - build-packages.yml: Dynamic matrix for all packages - build-image.yml: 5 board images with compression - publish-packages.yml: APT repo publishing - release.yml: Unified release orchestration APT repository scripts: - export-secrets.sh: Export GPG/SSH keys for GitHub Actions - local-publish.sh: Local test server - install.sh: User installation script Security (Phase 5): - AppArmor profiles for all services - Audit rules for SecuBox services - build-all.sh for local builds Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
49 lines
1.3 KiB
Bash
Executable File
49 lines
1.3 KiB
Bash
Executable File
#!/bin/bash
|
|
# Install SecuBox AppArmor profiles
|
|
# Run as root
|
|
|
|
set -e
|
|
|
|
SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
|
|
APPARMOR_DIR="$SCRIPT_DIR/../common/apparmor"
|
|
|
|
# Check root
|
|
[ "$(id -u)" -eq 0 ] || { echo "Run as root"; exit 1; }
|
|
|
|
# Check AppArmor
|
|
if ! aa-status >/dev/null 2>&1; then
|
|
echo "AppArmor not running, installing..."
|
|
apt-get install -y apparmor apparmor-utils
|
|
fi
|
|
|
|
echo "Installing SecuBox AppArmor profiles..."
|
|
|
|
# Install base abstractions
|
|
mkdir -p /etc/apparmor.d/local
|
|
cp "$APPARMOR_DIR/secubox-base" /etc/apparmor.d/local/secubox-base
|
|
|
|
# Install service profiles
|
|
for profile in "$APPARMOR_DIR"/usr.lib.secubox.*; do
|
|
if [ -f "$profile" ]; then
|
|
name=$(basename "$profile")
|
|
echo "Installing profile: $name"
|
|
cp "$profile" /etc/apparmor.d/"$name"
|
|
fi
|
|
done
|
|
|
|
# Reload AppArmor profiles
|
|
echo "Reloading AppArmor profiles..."
|
|
systemctl reload apparmor || apparmor_parser -r /etc/apparmor.d/usr.lib.secubox.* 2>/dev/null || true
|
|
|
|
# Show status
|
|
echo ""
|
|
echo "Installed profiles:"
|
|
aa-status 2>/dev/null | grep secubox || echo "Profiles installed (need service restart to apply)"
|
|
|
|
echo ""
|
|
echo "To apply profiles, restart SecuBox services:"
|
|
echo " systemctl restart secubox-hub secubox-mail secubox-wireguard secubox-crowdsec"
|
|
echo ""
|
|
echo "To check a profile is working:"
|
|
echo " aa-status | grep secubox"
|