lainOS/protocol-7-core
lainOS/protocol-7-core
3
0
Fork 0
Code Issues Pull requests Projects Releases 11 Packages Wiki Activity Actions
11 releases 11 tags
  • 5.5.3-26 b584bc9ff4

    protocol7-core-5.5.3-26 Stable

    amnesia released this 2026-07-17 13:22:37 +02:00 | 2 commits to main since this release

    protocol7-core-5.5.3-26 ~ Changelog

    Security Hardening ~ Complete Filesystem Isolation (lainos-dbus-bridge and lainos-notifyd)

    Both daemons now implement the full set of systemd filesystem-sandboxing equivalents:

    • ProtectSystem=strict equivalent: private mount namespace (unshare(CLONE_NEWNS)) with the root filesystem remounted read-only (MS_BIND | MS_RDONLY), preceded by an MS_PRIVATE remount to prevent propagation back to the real, shared namespace.
    • PrivateTmp=true equivalent: a fresh, size-limited (16MB), nosuid/nodev tmpfs mounted over /tmp, invisible to and from the real system /tmp.
    • ProtectHome=true equivalent: /home and /root replaced with empty, read-only, zero-size tmpfs mounts, hiding all user data from either daemon regardless of discretionary file permissions.
    • PrivateDevices=true equivalent: the real devtmpfs (thousands of device nodes) replaced with a minimal tmpfs containing only /dev/null, /dev/zero, /dev/urandom, /dev/random.

    All isolation steps run while still root, before privilege drop, since unshare()/mount()/mknod() require CAP_SYS_ADMIN (lost immediately after) and are intentionally absent from the seccomp whitelist. All failures on the read-only-root and /tmp//dev steps are fatal; /home//root mount failures are logged and treated as non-fatal (a configuration difference, not an isolation failure, e.g. on a system without a separate /root).

    Verification (both daemons, on real rc-service-managed production processes):

    • All four mounts confirmed active via direct /proc/<pid>/mounts inspection, correctly layered over the real, live mounts (visible in the same output for comparison) rather than replacing them system-wide.
    • Full dfuzzer 2.6 regression pass on lainos-dbus-bridge after each incremental addition ~ Exit status: 0, all methods/properties PASS throughout.
    • Valgrind memcheck on both daemons, at each checkpoint ~ 0 errors, 0 leaks throughout; reachable-memory figures traced via backtrace inspection at each step, confirmed to be pure libdbus-internal bookkeeping (not application code) whenever the byte count shifted between runs.
    • lainos-notifyd exercised with real traffic (a live Tor service restart, generating genuine sd_notify messages) while under Valgrind's supervision at the final checkpoint.
    • Functional D-Bus smoke test (CanReboot) confirmed correct throughout.
    • Binary hashes (md5sum) verified matching between the tested builds and the actual production binaries for both daemons, at the final checkpoint.

    This completes the filesystem-isolation work for both daemons. Combined with the seccomp hardening (5.5.3-24) and capability bounding-set clearing (5.5.3-25), protocol7-core's two most exposed daemons now have privilege drop, syscall restriction, capability restriction, and filesystem isolation all implemented and verified, matching the full breadth of systemd's per-service sandboxing model as hardened by Whonix without depending on systemd itself.

    Downloads