x12: add hardened setup

1 files changed, 103 insertions, 0 deletions

diff --git a/bin/hardened b/bin/hardened
new file mode 100755
index 0000000..30deb42
--- /dev/null
+++ b/bin/hardened
@@ -0,0 +1,103 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+root="$XDG_RUNTIME_DIR/hardened"
+home="$root/home"
+wayland="$XDG_RUNTIME_DIR/$WAYLAND_DISPLAY"
+resolver="$root/resolv.conf"
+
+bwrap_bin="$(command -v bwrap)"
+emacs_bin="$(readlink -f "$(command -v emacs)")"
+profile="$(readlink -f "$HOME/.nix-profile")"
+
+mkdir -p "$home/.emacs.d" "$home/.nix-profile"
+chmod 700 "$root" "$home"
+printf 'nameserver 1.1.1.1\nnameserver 9.9.9.9\noptions edns0\n' >"$resolver"
+
+HARDENED_ROUTES4="$(ip -4 route show scope link | awk '$1 != "default" && $1 ~ /\// {print $1}')"
+HARDENED_ROUTES6="$(ip -6 route show | awk '$1 != "default" && $1 ~ /\// {print $1}')"
+export HARDENED_ROUTES4 HARDENED_ROUTES6
+
+emacs_args=()
+
+for arg in "$@"; do
+  case "$arg" in
+    "$home")
+      emacs_args+=("$HOME")
+      ;;
+    "$home/"*)
+      emacs_args+=("$HOME/${arg#"$home/"}")
+      ;;
+    *)
+      emacs_args+=("$arg")
+      ;;
+  esac
+done
+
+exec pasta \
+  --config-net \
+  --map-host-loopback none \
+  --no-map-gw \
+  -t none \
+  -u none \
+  -T none \
+  -U none \
+  -- \
+  /run/current-system/sw/bin/bash -c '
+set -euo pipefail
+for subnet in 10.0.0.0/8 100.64.0.0/10 169.254.0.0/16 172.16.0.0/12 192.168.0.0/16 224.0.0.0/4 240.0.0.0/4; do
+  iptables -A OUTPUT -d "$subnet" -j REJECT
+done
+while IFS= read -r subnet; do
+  if [[ -n "$subnet" ]]; then iptables -A OUTPUT -d "$subnet" -j REJECT; fi
+done <<<"$HARDENED_ROUTES4"
+for subnet in fc00::/7 fe80::/10 ff00::/8; do
+  ip6tables -A OUTPUT -d "$subnet" -j REJECT
+done
+while IFS= read -r subnet; do
+  if [[ -n "$subnet" ]]; then ip6tables -A OUTPUT -d "$subnet" -j REJECT; fi
+done <<<"$HARDENED_ROUTES6"
+exec "$@"
+' hardened-network "$bwrap_bin" \
+  --unshare-all \
+  --share-net \
+  --unshare-user \
+  --disable-userns \
+  --new-session \
+  --cap-drop ALL \
+  --clearenv \
+  --dir /nix \
+  --ro-bind /nix/store /nix/store \
+  --ro-bind /etc /etc \
+  --ro-bind "$resolver" /etc/resolv.conf \
+  --dir /run \
+  --ro-bind /run/current-system /run/current-system \
+  --dir /run/user \
+  --dir "/run/user/$UID" \
+  --bind "$wayland" "$wayland" \
+  --proc /proc \
+  --dev /dev \
+  --tmpfs /tmp \
+  --dir /home \
+  --bind "$home" "$HOME" \
+  --dir "$HOME/.emacs.d" \
+  --overlay-src "$HOME/.emacs.d" \
+  --tmp-overlay "$HOME/.emacs.d" \
+  --ro-bind "$profile" "$HOME/.nix-profile" \
+  --dir /usr \
+  --symlink /run/current-system/sw/bin /bin \
+  --symlink /run/current-system/sw/bin /usr/bin \
+  --chdir "$HOME" \
+  --hostname hardened \
+  --setenv HOME "$HOME" \
+  --setenv USER "$USER" \
+  --setenv LOGNAME "$USER" \
+  --setenv PATH "$HOME/.nix-profile/bin:/run/current-system/sw/bin" \
+  --setenv SHELL "${SHELL:-/bin/sh}" \
+  --setenv LANG "${LANG:-C.UTF-8}" \
+  --setenv TERM "${TERM:-xterm-256color}" \
+  --setenv XDG_RUNTIME_DIR "/run/user/$UID" \
+  --setenv XDG_DATA_DIRS "$HOME/.nix-profile/share:/run/current-system/sw/share" \
+  --setenv WAYLAND_DISPLAY "$WAYLAND_DISPLAY" \
+  --setenv GDK_BACKEND wayland \
+  "$emacs_bin" "${emacs_args[@]}"