blob: 30deb42c2881ff58041043e8cb9f85339a096c91 (
plain) (
blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
|
#!/usr/bin/env bash
set -euo pipefail
root="$XDG_RUNTIME_DIR/hardened"
home="$root/home"
wayland="$XDG_RUNTIME_DIR/$WAYLAND_DISPLAY"
resolver="$root/resolv.conf"
bwrap_bin="$(command -v bwrap)"
emacs_bin="$(readlink -f "$(command -v emacs)")"
profile="$(readlink -f "$HOME/.nix-profile")"
mkdir -p "$home/.emacs.d" "$home/.nix-profile"
chmod 700 "$root" "$home"
printf 'nameserver 1.1.1.1\nnameserver 9.9.9.9\noptions edns0\n' >"$resolver"
HARDENED_ROUTES4="$(ip -4 route show scope link | awk '$1 != "default" && $1 ~ /\// {print $1}')"
HARDENED_ROUTES6="$(ip -6 route show | awk '$1 != "default" && $1 ~ /\// {print $1}')"
export HARDENED_ROUTES4 HARDENED_ROUTES6
emacs_args=()
for arg in "$@"; do
case "$arg" in
"$home")
emacs_args+=("$HOME")
;;
"$home/"*)
emacs_args+=("$HOME/${arg#"$home/"}")
;;
*)
emacs_args+=("$arg")
;;
esac
done
exec pasta \
--config-net \
--map-host-loopback none \
--no-map-gw \
-t none \
-u none \
-T none \
-U none \
-- \
/run/current-system/sw/bin/bash -c '
set -euo pipefail
for subnet in 10.0.0.0/8 100.64.0.0/10 169.254.0.0/16 172.16.0.0/12 192.168.0.0/16 224.0.0.0/4 240.0.0.0/4; do
iptables -A OUTPUT -d "$subnet" -j REJECT
done
while IFS= read -r subnet; do
if [[ -n "$subnet" ]]; then iptables -A OUTPUT -d "$subnet" -j REJECT; fi
done <<<"$HARDENED_ROUTES4"
for subnet in fc00::/7 fe80::/10 ff00::/8; do
ip6tables -A OUTPUT -d "$subnet" -j REJECT
done
while IFS= read -r subnet; do
if [[ -n "$subnet" ]]; then ip6tables -A OUTPUT -d "$subnet" -j REJECT; fi
done <<<"$HARDENED_ROUTES6"
exec "$@"
' hardened-network "$bwrap_bin" \
--unshare-all \
--share-net \
--unshare-user \
--disable-userns \
--new-session \
--cap-drop ALL \
--clearenv \
--dir /nix \
--ro-bind /nix/store /nix/store \
--ro-bind /etc /etc \
--ro-bind "$resolver" /etc/resolv.conf \
--dir /run \
--ro-bind /run/current-system /run/current-system \
--dir /run/user \
--dir "/run/user/$UID" \
--bind "$wayland" "$wayland" \
--proc /proc \
--dev /dev \
--tmpfs /tmp \
--dir /home \
--bind "$home" "$HOME" \
--dir "$HOME/.emacs.d" \
--overlay-src "$HOME/.emacs.d" \
--tmp-overlay "$HOME/.emacs.d" \
--ro-bind "$profile" "$HOME/.nix-profile" \
--dir /usr \
--symlink /run/current-system/sw/bin /bin \
--symlink /run/current-system/sw/bin /usr/bin \
--chdir "$HOME" \
--hostname hardened \
--setenv HOME "$HOME" \
--setenv USER "$USER" \
--setenv LOGNAME "$USER" \
--setenv PATH "$HOME/.nix-profile/bin:/run/current-system/sw/bin" \
--setenv SHELL "${SHELL:-/bin/sh}" \
--setenv LANG "${LANG:-C.UTF-8}" \
--setenv TERM "${TERM:-xterm-256color}" \
--setenv XDG_RUNTIME_DIR "/run/user/$UID" \
--setenv XDG_DATA_DIRS "$HOME/.nix-profile/share:/run/current-system/sw/share" \
--setenv WAYLAND_DISPLAY "$WAYLAND_DISPLAY" \
--setenv GDK_BACKEND wayland \
"$emacs_bin" "${emacs_args[@]}"
|
