alip

Mon, 08 Jun 2026 06:33:06 +0000

#Sydbox 3.55.0 is released! Introduces Domain Transitions to change sandbox policy manually or based on a set of events. IPC thread is hardened to set a limit on max connections and disconnect idle connections. Includes some minor security fixes for sandbox capabilities as well. Full story: https://gitlab.exherbo.org/sydbox/sydbox/-/blob/main/ChangeLog.md #exherbo #linux #security

Sun, 07 Jun 2026 16:16:01 +0000

#Sydbox now passes Linux Testing Project tests on #x32 architecture. Portability matters, even if x32 is very little in use, it has similarities to architectures such as #mips64n32 which we cannot easily test. #exherbo #linux #security

Sun, 07 Jun 2026 12:14:31 +0000

News from #Sydbox #git: As of version 3.55.0, bind mounts are secure by default. Regardless of whether the source is an absolute path or a filesystem type, every bind is mounted with nodev, noexec, nosuid, and nosymfollow options applied. User must therefore explicitly opt back into the relaxed behaviour upfront using the options dev, exec, suid and symfollow: https://man.exherbo.org/syd.2.html#bind #exherbo #linux #security

Fri, 05 Jun 2026 14:38:43 +0000

News from #Sydbox #git for #Emacs users: Self-contained syd.el which has full support for the syd(2) API now supports syntax hilighting for syd-3 profiles exactly like Syd's #vim syntax hilighting.
#exherbo #linux #security

Fri, 05 Jun 2026 09:07:16 +0000

News from #sydbox #git: We have #Caitsith like Domain Transitions now which allows you to change sandbox policy atomically either manually or upon certain events such as exec, chdir, mmap, bind, connect, accept. One example would be restricten the confinement of a web server upon first bind another example is per-directory sandbox policies. There're many other nice uses, see examples: https://man.exherbo.org/syd.7.html#Domain_Transitions #exherbo #linux #security

Sat, 30 May 2026 12:50:03 +0000

#Sydbox 3.54.1 released! Security release with fcntl(2) hardening against SIGIO bypass of #landlock signal scoping. Adds log rate limiting with log/rlimit_interval and log/rlimit_burst options. New deleted file access mediation denies unlinked files through open fds. chown(2) confined to caller's credentials by default, force_umask default now 7000 for setuid/setgid/sticky stripping like #OpenBSD #pledge. Ghost mode implies lock:on. Full story: https://gitlab.exherbo.org/sydbox/sydbox/-/blob/main/ChangeLog.md #exherbo #linux #security

Fri, 22 May 2026 00:00:56 +0000

New hardening in #sydbox #git: Deleted File Access Mediation, inspired by #AppArmor flag PATH_MEDIATE_DELETED: https://man.exherbo.org/syd.7.html#Deleted_File_Access_Mediation #exherbo #linux #security

Thu, 14 May 2026 13:27:15 +0000

#Sydbox containers are not affected by the new LPE #Fragnesia because: 1. Unprivileged user/network namespaces are denied unless trace/allow_unsafe_namespace:user,net 2. Kernel algorithm (AF_ALG) sockets are denied unless trace/allow_unsafe_kcapi:true 3. Socket option TCP_ULP is denied unless trace/allow_unsafe_setsockopt:true. You may sleep in peace: https://raw.githubusercontent.com/v12-security/pocs/d4043edc2acbd75d093e3f5795751b678c66b259/fragnesia/fragnesia.c #exherbo #linux #security

Tue, 12 May 2026 18:27:27 +0000

I made an #asciicast showcasing Ghost Mode of #sydbox: https://asciinema.org/a/1039185 #exherbo #linux #security

Tue, 12 May 2026 16:20:09 +0000

#Sydbox 3.53.0 is released! This is a feature release improving sandbox categories walk, stat, and adding the new category list for directory listing which allows easy use of walk+list categories for path hiding. readlink is also split from stat category which is by far the most common syscall so this helps with overhead of other categories. We also have bunch of security fixes. Full story, as always, is in the ChangeLog, thanks for flying Syd: https://gitlab.exherbo.org/sydbox/sydbox/-/blob/main/ChangeLog.md?ref_type=heads#3530 #exherbo #linux #security

Fri, 08 May 2026 22:09:36 +0000

Fun exercise for #Syd users: Run "PATH= /path/to/syd" and try to break out of the default restricted #bash shell session. You're in a directory that does not exist and you have no access to external commands. It's not easy or where's the fun? #exherbo #linux #security

Wed, 06 May 2026 12:57:46 +0000

AF_ALG is marked deprecated as response to copy.fail. Somewhat sad to see a useful API die: https://lore.kernel.org/linux-crypto/20260430011544.31823-1-ebiggers@kernel.org/ #exherbo #linux #security

Sat, 02 May 2026 14:40:46 +0000

News from #Sydbox #git: New option trace/force_wx_open: Specify whether creating/writing open(2) family system calls for executables should be denied regardless of path. This option is restricted to creat, open, openat, and openat2 syscalls and may be combined with trace/force_umask option to confine filesystem as Write XOR Execute. New profile "wx" combines the new option with trace/force_umask:7177 to confine filesystem as W^X. User profile includes wx profile. #exherbo #linux #security

Fri, 01 May 2026 20:28:51 +0000

#Sydbox 3.52.0 is released! I've just merged 428 commits from next to main to make this release. It includes no new features, only bug fixes. Some of these bug fixes are security critical and you're recommended to upgrade as soon as possible. Full story, as always, is in the ChangeLog, thanks for flying Syd: https://gitlab.exherbo.org/sydbox/sydbox/-/blob/main/ChangeLog.md #exherbo #linux #security

Thu, 30 Apr 2026 19:14:06 +0000

Mitigation against copy.fail in upcoming #Sydbox: Syd will reject to open SUID files regardless of mode unless the option trace/allow_unsafe_open_suid:1 is set. This does not prevent exploitation altogether as the attacker can write to files such as /etc/passwd, however it raises the bar with very little added cost. #exherbo #linux #security

Thu, 30 Apr 2026 17:47:55 +0000

#GVisor supports only x86_64, arm64 yet they claim they run everywhere. #Sydbox passes tests on x86_64, i686, x32, arm64, armv7, ppc64, ppc64le, ppc, s390x, loongarch64, mips64el, and mipsel but I won't claim we are portable until we have mips64, mips, m68k and sparc! Huge thanks to Compile Farm people for enabling us to test Syd on various different architectures! #exherbo #linux #security

Thu, 30 Apr 2026 16:08:26 +0000

Correction: I was wrong about copy.fail and #sydbox earlier: Force sandboxing and Crypt sandboxing _imply_ the option trace/allow_safe_kcapi:1 so when these two are in use the sandbox process can abuse the AEAD issue in the #Linux #kernel. With #sydbox 3.52.0 to be released very soon, we rename the trace/allow_safe_kcapi option to trace/allow_unsafe_kcapi and Force/Crypt sandboxing are no longer going to imply this option, rather allow only Syd's use of AF_ALG sockets. #exherbo #linux #security

Thu, 30 Apr 2026 08:17:23 +0000

New #container breakout: https://copy.fail/ #sydbox containers aren't affected because Syd denies access to Kernel Cryptography API (KCAPI, AF_ALG sockets) by default unless trace/allow_safe_kcapi:1 is specified at startup. Crypt Sandboxing is also not affected because we don't use AEAD but CTR(AES). #exherbo #linux #security

Mon, 27 Apr 2026 16:29:58 +0000

#Sydbox is on #Radicle with ID rad:z38HCnbmcDegA2BMxuPaPRPMdp6wF seed it and share the love! Huge thanks to #HardenedBSD folks for seeding! #exherbo #linux #security #git

Sat, 11 Apr 2026 19:17:19 +0000

Here is a #landlock oddity I noticed and reported today: https://github.com/landlock-lsm/linux/issues/58 #exherbo #linux #security