Would apparmor profiles and other default hardening by packages if any be added “on top”?
Could you please scratch Whonix from the name / folder names? I guess this could be generic. Could be part of apparmor-profile-everything?
main_app_dir=“/usr/share/whonix-apps”
Possibly better in user’s /home folder?
How would an application by started by default using the sandbox wrapper without needing to prepend on command line? The good old problem of non-existence of stackable wrappers.
I guess this sandbox wrapper could be implemented without solving the stackable wrappers issue but to really make applications benefit by default (actual Kicksecure / Whonix integration) would require that to be done.
TODO: X11 sandbox
Rather than bothering with X11 (which’s days are numbered hopefully in any case), could you figure out change XFCE’s window manager with a window manager that uses wayland? (Wayland and that idea was mentioned here Enlightenment DE - #10 by Patrick)
Yes. They’d be good for even further confinement as they can be tuned for the program.
I think they should be separate. A sandboxing framework can have a lot of use without a full system apparmor policy.
No, all apps are meant to have their own user with their own home folder and be completely isolated from the user’s own home folder. A sandbox isn’t much good if the app can easily access all of the user’s files and other app data.
We could add a few folders that are accessible by all apps so they can share files across.
Yes. They’d be good for even further confinement as they can be tuned for the program.
Nice.
I think they should be separate. A sandboxing framework can have a lot of use without a full system apparmor policy.
Ok, makes sense.
No, all apps are meant to have their own user with their own home folder and be completely isolated from the user’s own home folder. A sandbox isn’t much good if the app can easily access all of the user’s files and other app data.
We could add a few folders that are accessible by all apps so they can share files across.
Yes.
Running an application under a different user will cause a usability
mess. Imagine downloading a file with Tor Browser and then the user
trying to find that file. Maybe at the same time symlinks to these
folders could be added to the user’s home folder or something?
That C code looks short enough.
(I don’t count the many different DENY_SYSCALL since these don’t represent a challange in understanding C code.)
Please keep the C code short as I have to ask favors to get review for these.
/* TODO: Use a whitelist */
Dunno what that means but hopefully not 100s of lines of C code. Ideally any wrappers could be in script languages outside of C if a lot more complexity is required.
It’d essentially just change DENY_SYSCALL to ALLOW_SYSCALL and then have a list of syscalls to allow rather than a list of syscalls to deny. All syscalls not listed will be denied. It’s far more effective than a blacklist.
checksec output:
RELRO STACK CANARY NX PIE RPATH RUNPATH Symbols FORTIFY Fortified Fortifiable FILE
Full RELRO No canary found NX enabled PIE enabled No RPATH No RUNPATH 76 Symbols No 0 0 seccomp
hardening-check output:
seccomp:
Position Independent Executable: yes
Stack protected: no, not found!
Fortify Source functions: unknown, no protectable libc functions used
Read-only relocations: yes
Immediate binding: yes
Stack clash protection: unknown, no -fstack-clash-protection instructions found
Control flow integrity: unknown, no -fcf-protection instructions found!
It does this by only allowing specific uses of the socket() syscall rather than blocking it entirely. We can use this for other things like ioctl filtering too (via the ioctl() syscall).
SIOCGIFHWADDR could be another good ioctl to blacklist. It retrieves the MAC address which may be a privacy issue (although not for Whonix as everyone uses the same MAC). I’ve tested this and it kills ifconfig but ip a seems to still get the MAC.
I’m also going to look into implementing W^X via restricting mmap() and mprotect() calls (systemd does this with MemoryDenyWriteExecute=).