#exherbo — Public Fediverse posts
Live and recent posts from across the Fediverse tagged #exherbo, aggregated by home.social.
-
News from #sydbox #git: Adding #landlock ABI 9 support which comes with the new filesystem access right ResolveUnix to confine connect/send to UNIX domain sockets. This is similar to Syd's "net/connect" category which accepts paths. Landlock category "lock/bind" already supported paths for MakeSock right, now we add path support to "lock/connect" for ResolveUnix. Pandora will also learn to generate new rules: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=ae97330d1bd6a97646c2842d117577236cb40913 #exherbo #linux #security
-
News from #sydbox #git: We have #Caitsith like Domain Transitions now which allows you to change sandbox policy atomically either manually or upon certain events such as exec, chdir, mmap, bind, connect, accept. One example would be restricten the confinement of a web server upon first bind another example is per-directory sandbox policies. There're many other nice uses, see examples: https://man.exherbo.org/syd.7.html#Domain_Transitions #exherbo #linux #security
-
Thanks to everyone for the amazing #FOSDEM You may watch all my #sydbox talks, including the one from #fosdem2026 here: https://www.youtube.com/@AliPolatel #exherbo #linux #security #rustlang
-
Watch this video, https://www.youtube.com/watch?v=_6BcuHpp9eU and vote this person as president. #sydbox denies sysipvc(7) API by default, thank me later: https://man.exherbo.org/syd.7.html#Shared_Memory_Hardening #exherbo #linux #security #sidechannel
-
Had I printed the #sydbox manual pages as a #pdf and sell it on a print-on-demand service, would you buy it to contribute to the project? It's pretty basic at the moment but looks roughly reasonable. Pipeline is #scdoc -> #man -> #pandoc -> #markdown -> #pandoc -> #latex -> #lualatex -> #pdf. I regenerate it every release, it's about 300 pages: https://gitlab.exherbo.org/sydbox/sydbox/-/blob/main/doc/manual/syd-manual.pdf #exherbo #linux #security
-
I ran the #ELF #parser of #sydbox over 60k #Linux #malware samples from #Virusshare and 40k orcs which are malformed elves generated by the Melkor ELF #Fuzzer and got no crashes. The parser is written in #rustlang. It's free from unsafe code and arithmetic side effects. Syd parses ELF at exec(3) and mmap(2) boundary to perform various restrictions for binaries such as PIE and non-executable stack. #exherbo #security
-
I have just submitted this issue, https://github.com/nushell/nushell/issues/16081 for #nushell + #sydbox integration for a well-confined and audited default shell. Hopefully we can provide a portable base to include #FreeBSD's #Capsicum, #OpenBSD's #pledge and #NetBSD's #secmodel supported one day too! Imagine your #shell covering your ass when you tell noone but #curl #bash at 3 am on a nightshift trying not to wake anyone up! Feedback much appreciated! #exherbo #security
-
Updated #sydbox to 3.35.0: hardened #Landlock, empty mount namespaces using pivot_root and root:tmpfs a la #bubblewrap, many bug fixes thx to LTP, many bug/portability fixes thx to #alpine #linux folks. New utilities #syd-fd and #syd-x. See the release mail for more information: https://is.gd/syd_3_35_0 #exherbo #hacking #security
-
syd-3.13.1 has been released: fixes readlink path issues, boosts stat sandboxing with readlink enhancements, updates MSRV to 1.71, secures /proc magiclinks against sandbox escapes, and strengthens container security with advanced resolution strategies. See https://man.exherbolinux.org. Want to test your hacking skills? Check out syd #ctf at https://ctftime.org/event/2178 #exherbo #gnu #linux #seccomp #landlock #container #rust #rustlang
-
SydB☮x-3.11.1 has been released: new syd-run tool to run commands inside syd containers, hardening of sandbox process environment, and many minor fixes. syd-ldd - syd's secure alternative to ldd(1) - now uses the stricter 'immutable' profile rather than the 'container' profile ... see: https://sydbox.exherbolinux.org #sydbox #exherbo #gnu #linux #seccomp #landlock #container #rust #rustlang
-
SydB☮x-3.10.0 has been released: trace mode to automatically generate sandboxing profiles, support for immutable containers and private /tmp, ... see: https://sydbox.exherbolinux.org #sydbox #exherbo #gnu #linux #seccomp #landlock #container #rust #rustlang
-
I might’ve already posted about this, but someone just reminded me of my achieving Linux enlightenment moment. Many years ago I was fascinated with more and more “advanced” distros and as one does at some point installed Arch Linux and I was talking to my father (IT-saur) about how it doesn’t do anything by default unless you tell it to and it’s so cool to set up my system exactly how I want relatively from scratch even if it sometimes takes some time and effort.
He responded that it seems kinda backwards, and that he remembers when some version of bash installer came out and if ran normally it would automatically detect everything and set up with sane defaults without any need for further tinkering. You run the installer, you get functional bash. And I suddenly realised he’s right; that was the future and I believe it’s still the way now, I’m all for customising my system as much as I want, but I’d like my software to install with sane defaults and presumptions and not require me to understand its inner workings and connections to other parts of the system just to be able to use it. Software should work for me and save me time and effort if I so desire.
This is something that Gentoo, Exherbo and especially NixOS do much better.
-
I might’ve already posted about this, but someone just reminded me of my achieving Linux enlightenment moment. Many years ago I was fascinated with more and more “advanced” distros and as one does at some point installed Arch Linux and I was talking to my father (IT-saur) about how it doesn’t do anything by default unless you tell it to and it’s so cool to set up my system exactly how I want relatively from scratch even if it sometimes takes some time and effort.
He responded that it seems kinda backwards, and that he remembers when some version of bash installer came out and if ran normally it would automatically detect everything and set up with sane defaults without any need for further tinkering. You run the installer, you get functional bash. And I suddenly realised he’s right; that was the future and I believe it’s still the way now, I’m all for customising my system as much as I want, but I’d like my software to install with sane defaults and presumptions and not require me to understand its inner workings and connections to other parts of the system just to be able to use it. Software should work for me and save me time and effort if I so desire.
This is something that Gentoo, Exherbo and especially NixOS do much better.
-
I might’ve already posted about this, but someone just reminded me of my achieving Linux enlightenment moment. Many years ago I was fascinated with more and more “advanced” distros and as one does at some point installed Arch Linux and I was talking to my father (IT-saur) about how it doesn’t do anything by default unless you tell it to and it’s so cool to set up my system exactly how I want relatively from scratch even if it sometimes takes some time and effort.
He responded that it seems kinda backwards, and that he remembers when some version of bash installer came out and if ran normally it would automatically detect everything and set up with sane defaults without any need for further tinkering. You run the installer, you get functional bash. And I suddenly realised he’s right; that was the future and I believe it’s still the way now, I’m all for customising my system as much as I want, but I’d like my software to install with sane defaults and presumptions and not require me to understand its inner workings and connections to other parts of the system just to be able to use it. Software should work for me and save me time and effort if I so desire.
This is something that Gentoo, Exherbo and especially NixOS do much better.
-
@TheFake_VIP I’d like to have my #Exherbo and something like Ubuntu or Mint alongside each other so that for everyday use and geek stuff I can use Exherbo, and when I want to play Steam games or am struggling with something on Exherbo I can just switch to the “just works” system that every linux software supports. The problem is that using the same homedir introduces a bunch of problems with synchronising user IDs etc. Homed solves that.
Now if only btrfs driver for windows was production ready, I’d have all three systems for dealing with stubborn applications able to use the same filesystem to store shared stuff. Sadly, after it massacred my main data storage partition about a year ago I’m not ready to trust it.
-
@TheFake_VIP I’d like to have my #Exherbo and something like Ubuntu or Mint alongside each other so that for everyday use and geek stuff I can use Exherbo, and when I want to play Steam games or am struggling with something on Exherbo I can just switch to the “just works” system that every linux software supports. The problem is that using the same homedir introduces a bunch of problems with synchronising user IDs etc. Homed solves that.
Now if only btrfs driver for windows was production ready, I’d have all three systems for dealing with stubborn applications able to use the same filesystem to store shared stuff. Sadly, after it massacred my main data storage partition about a year ago I’m not ready to trust it.
-
#linux #freebsd #nixos #guix #gentoo #exherbo #archlinux
in recent time i was forced to explain difference about linux packaging multiple time, i am a bit tired of this, so i decided to write short article about it (probably will be updated from time to time)
as far as i know currently exists following unix package management systems:
1. no package management as example of "no package management" system look at LFS #^http://www.linuxfromscratch.org/lfs/
this type of package management is no centralized package database or package management tool, all management done by end user (you), benefits of this is what you are free to do everything you wish without any limitations from package management tools including wrong dependencies resolution, limited package options or no package options at all e.t.c., cons - you must know what to do, no package tracking which lead to harder package remove or upgrade process, no automatic dependencies handling e.t.c.
2. binary package management systems, most popular is: deb - #^https://www.debian.org/ , rpm #^https://www.redhat.com/en, relatively new pacman packaging system from arch - #^https://www.archlinux.org/, and i think here is some more of this kind of package management systems.
this type of package management provide base automation of package management, like install, update, uninstall they often do dependency tracking, can automatically install all necessary packages and uninstall unused dependencies which definitely make life a lot easier. This kind of package management does have big flaws and limitations. first of all most of such systems are monolithic (read as: can install/update packages of exactly one state of a system, for example on system like 3-5 years old you can't update just firefox package, you will be forced to update most of packages, so you either update everything or nothing and this often can break system)
3. source based systems: FreeBSD ports - #^https://www.freebsd.org/ports/ , Gentoo portage - #^https://www.gentoo.org/ , Exherbo paludis - #^https://www.exherbo.org/ : this kind of package management systems is similar to binary package management systems, but most software can/must be built directly from source code which provide some additional features (NOTE: often this is hybrid system and base system for initial deploy provided in binary form, also package manager can install binary packages)
this type of package management provide following advantages over binary package management(features may vary a bit from system to system):
1) you can safely update only top level packages (packages which does not have any package dependent on them, for example firefox), this is really big advantage for system with not so often updates
2) due to fact what most packages are built from source, it is often possible to tune package options. turn on/off package components, apply patches
3) C/CXX FLAGS and other types of compile-time optimizations - topic of flames and holy wars, but it is sometime really useful, and yes often causing problems
4) easy package source-code review/edit.
4. i do not know how to call it properly, but let's name it "shared store package management" : nix - #^https://nixos.org/ , guix - #^https://guix.gnu.org/ , i recently learned about this kind of package management systems and found it very interesting, in practice it's more than just package managers, software must be built in special way to work with this package managers, but provided features are killer features:
1) package are "virtually" completely independent on each other, you can install, update or uninstall any package in any order (with some little exceptions where package provide same EXECUTABLE, libraries conflicts are handled and avoided)
2) transactional package install/uninstall, half-broken or broken state is impossible (in terms of package install/uninstall/update, of course you can do a wrong config for program from package which will lead to broken behaviour)
3) install/update/uninstall history with possibility to switch to any revision
4) store deduplication (probably have a room for improvement, as far as i know currently it's just hardlinking of same files, but that a good start and does work surprisingly efficient)
5) both source and binary packages supported
6) another major feature of nix and guix is ability to install on foreign host system, you can install nix or/and guix on you fancy shitbuntu or outdated debian and it will work just fine (mostly), it does have some limitations on foreign hosts, also it does have more bugs on foreign hosts, but overall usable.
5. here is even more package management types, flatpak - it's like "shared store package management", does not have own os distribution, instead targeted on any linux system, have similarities with "shared store package management" systems, but different ), does not have de-duplication as far as i know, so it's VERY fat and space hungry, have namespace based isolation by default, but it's declared not as security feature, but measure to pervent config mess, overall it's not too good and not very unique system, but one thing make it worth adding to this list, it's very good fit for proprietary software, and it have large non distro bound repository with software, including proprietary software.
6. snap - bloated, plagued variant of flatpak, read as flatpak with integrated windows-update, another "gift" from canonical already known for corrupting debian ), snap mentioned here just for people to know what it should be avoided if possible.
i am decided what for future deployment nix/guix is best option, also i am already using it on outdated systems in some places. -
Diverse Linux, a spin of Exherbo
-
Diverse Linux, a spin of Exherbo
-
Well, I always suggest the same distro lately, because I'm contributing to it and it keeps improving daily. We have just added #s6 support, which can easily be the best init and rc service manager around.
Gentoo is nice but definitely over engineered. Also overlay concept is inferior to paludis repositories.
-
http://www.skarnet.org/software/s6/why.html
These developers have created something that works, is modular, simple and it's a perfectly crafted piece of software.
However this doesn't have a lot of support currently, there are only 2 distro which implements the s6 suite:
#obarun distro is an arch-based distro which uses this init and supervision suite.
There are also efforts to support this on #exherbo.
-
I didn't expect initializing the system to take all this time; 2 weeks and I have still so many things to do.
Maybe it is because i choosed to use a source based distro with almost no support.
Or because i choosed to have full encryption using luks.
Or to change init and service supervisor.All under exam session.
