diff options
| -rwxr-xr-x | bin/hardened | 103 |
1 files changed, 103 insertions, 0 deletions
diff --git a/bin/hardened b/bin/hardened new file mode 100755 index 0000000..30deb42 --- /dev/null +++ b/bin/hardened @@ -0,0 +1,103 @@ +#!/usr/bin/env bash +set -euo pipefail + +root="$XDG_RUNTIME_DIR/hardened" +home="$root/home" +wayland="$XDG_RUNTIME_DIR/$WAYLAND_DISPLAY" +resolver="$root/resolv.conf" + +bwrap_bin="$(command -v bwrap)" +emacs_bin="$(readlink -f "$(command -v emacs)")" +profile="$(readlink -f "$HOME/.nix-profile")" + +mkdir -p "$home/.emacs.d" "$home/.nix-profile" +chmod 700 "$root" "$home" +printf 'nameserver 1.1.1.1\nnameserver 9.9.9.9\noptions edns0\n' >"$resolver" + +HARDENED_ROUTES4="$(ip -4 route show scope link | awk '$1 != "default" && $1 ~ /\// {print $1}')" +HARDENED_ROUTES6="$(ip -6 route show | awk '$1 != "default" && $1 ~ /\// {print $1}')" +export HARDENED_ROUTES4 HARDENED_ROUTES6 + +emacs_args=() + +for arg in "$@"; do + case "$arg" in + "$home") + emacs_args+=("$HOME") + ;; + "$home/"*) + emacs_args+=("$HOME/${arg#"$home/"}") + ;; + *) + emacs_args+=("$arg") + ;; + esac +done + +exec pasta \ + --config-net \ + --map-host-loopback none \ + --no-map-gw \ + -t none \ + -u none \ + -T none \ + -U none \ + -- \ + /run/current-system/sw/bin/bash -c ' +set -euo pipefail +for subnet in 10.0.0.0/8 100.64.0.0/10 169.254.0.0/16 172.16.0.0/12 192.168.0.0/16 224.0.0.0/4 240.0.0.0/4; do + iptables -A OUTPUT -d "$subnet" -j REJECT +done +while IFS= read -r subnet; do + if [[ -n "$subnet" ]]; then iptables -A OUTPUT -d "$subnet" -j REJECT; fi +done <<<"$HARDENED_ROUTES4" +for subnet in fc00::/7 fe80::/10 ff00::/8; do + ip6tables -A OUTPUT -d "$subnet" -j REJECT +done +while IFS= read -r subnet; do + if [[ -n "$subnet" ]]; then ip6tables -A OUTPUT -d "$subnet" -j REJECT; fi +done <<<"$HARDENED_ROUTES6" +exec "$@" +' hardened-network "$bwrap_bin" \ + --unshare-all \ + --share-net \ + --unshare-user \ + --disable-userns \ + --new-session \ + --cap-drop ALL \ + --clearenv \ + --dir /nix \ + --ro-bind /nix/store /nix/store \ + --ro-bind /etc /etc \ + --ro-bind "$resolver" /etc/resolv.conf \ + --dir /run \ + --ro-bind /run/current-system /run/current-system \ + --dir /run/user \ + --dir "/run/user/$UID" \ + --bind "$wayland" "$wayland" \ + --proc /proc \ + --dev /dev \ + --tmpfs /tmp \ + --dir /home \ + --bind "$home" "$HOME" \ + --dir "$HOME/.emacs.d" \ + --overlay-src "$HOME/.emacs.d" \ + --tmp-overlay "$HOME/.emacs.d" \ + --ro-bind "$profile" "$HOME/.nix-profile" \ + --dir /usr \ + --symlink /run/current-system/sw/bin /bin \ + --symlink /run/current-system/sw/bin /usr/bin \ + --chdir "$HOME" \ + --hostname hardened \ + --setenv HOME "$HOME" \ + --setenv USER "$USER" \ + --setenv LOGNAME "$USER" \ + --setenv PATH "$HOME/.nix-profile/bin:/run/current-system/sw/bin" \ + --setenv SHELL "${SHELL:-/bin/sh}" \ + --setenv LANG "${LANG:-C.UTF-8}" \ + --setenv TERM "${TERM:-xterm-256color}" \ + --setenv XDG_RUNTIME_DIR "/run/user/$UID" \ + --setenv XDG_DATA_DIRS "$HOME/.nix-profile/share:/run/current-system/sw/share" \ + --setenv WAYLAND_DISPLAY "$WAYLAND_DISPLAY" \ + --setenv GDK_BACKEND wayland \ + "$emacs_bin" "${emacs_args[@]}" |