starred/nix-config
1
0 Fork 0
mirror of https://github.com/ryan4yin/nix-config.git synced 2026-11-13 12:13:46 +01:00
Code Issues Packages Projects Releases 10 Wiki Activity
Files
71fa928254a9f4f186323d2b1950cfe2433bb9b7
nix-config/hardening/README.md
T
ryan4yin | 二花 71fa928254 feat(canokey): sudo, SSH, LUKS and OpenPGP setup for daily use (#516) 
Use the CanoKey for daily authentication on idols-ai and shoukei, with
the existing passwords, passphrases and per-host SSH keys as fallback.

- sudo: pam_u2f with a shared origin (pam://ryan4yin) and a Nix-store
  authfile built from myvars.canokeyU2fKeys; the primary key is
  registered and touch-to-sudo works on idols-ai.
- SSH: one resident ed25519-sk key (application=ssh:ryan4yin) exported
  to ~/.ssh/id_ed25519_sk; GitHub tries it before the per-host key.
- shoukei LUKS: fido2-device=auto with token-timeout=10s. Update
  nixos-apple-silicon (linux-asahi 7.2.14), whose initrd adds
  thunderbolt_apple and reset_apple_cio so USB-C comes up before unlock.
- GPG: scdaemon disable-ccid so it uses pcscd.
- docs/security-keys.md: setup, PINs, enrollment, backup key and
  recovery; deduplicate the FIDO notes left by #515.

Assisted-by: Claude Code (claude-opus-5-5)
2026-11-04 01:50:21 -06:00

13 KiB
Raw Blame History

Linux Hardening

Deployed and interactively validated on the Linux desktop host (2026-10-31). Policy and limits: SECURITY.md.

Why these apps are sandboxed

The packaging scope is driven by blast radius and input exposure, not by treating the applications as malicious. These apps parse complex local or remote content, load third-party plugins (OBS), or hold powerful network/session privileges (Remmina); a parser, plugin or session compromise would otherwise inherit the user's home, session D-Bus, devices and network. Each wrapper grants only the ports, devices, sockets, writable directories and desktop portals needed by that app's documented workflow.

Shared boundaries

  • Cleared environment; filtered session D-Bus; private /dev/shm; per-app /tmp. Chromium-family browsers share an app-specific /tmp so external URLs reuse one browser instance.
  • Read-only /nix/store; GPU and display; fonts and themes; LAN and Internet.
  • Portals for file chooser, URI opening, notifications, input methods and document exports.
  • No whole host home, system D-Bus, SSH agent, raw USB/serial or raw camera. The only device passthrough is a security key's FIDO interface for Firefox/Chromium/Chrome; see Limits. Raw PipeWire is granted only to MuseScore for its ALSA-via-PipeWire audio path; see Limits.
  • Host loopback only for Firefox/Chromium; all other apps use pasta-isolated loopback. Chromium is an intentional development exception. Brave Origin and Edge are backup browsers and receive no media grants.

App permissions

Media means audio playback, microphone, Camera and ScreenCast portals. Writable paths are listed explicitly; other files use the document portal. Every app also has private writable state.

App Network Writable paths Grants
Firefox Host loopback ~/.mozilla, personal files, Trash, Firefox artwork Audio, browserpass, MPRIS, idle, FIDO2 key; camera/screen sharing intentionally unavailable
Chromium Host loopback ~/.config/chromium, personal files Media, browserpass, MPRIS, idle, FIDO2 key, v12 Secret
Chrome Isolated ~/.config/google-chrome, Downloads Media, browserpass, MPRIS, idle, FIDO2 key, v12 Secret
Brave Origin Isolated ~/.config/BraveSoftware/Brave-Origin, Downloads v12 Secret
Edge Isolated ~/.config/microsoft-edge, Downloads v12 Secret
QQ Isolated Personal files, private app state Media, notifications, tray, MPRIS, idle, accessibility
Telegram Isolated Personal files, private app state Media, notifications, tray, MPRIS, idle, accessibility, Ayatana indicators
Zoom Isolated ~/.zoom, zoomus.conf, zoom.conf, Downloads, Documents/Zoom, private app state Media, X11/XWayland, FHS, SNI tray, idle, /dev/video0-1, read-only /sys/class/drm
WeChat Isolated Documents, Downloads, app-scoped wechat data, private app state Media, Wayland, X11 fallback, SNI tray, file chooser portal
Foliate None Documents/Downloads/Pictures read-only, app-scoped state File chooser, OpenURI, notifications, IME, accessibility
Krita None Documents/Downloads/Pictures writable, app-scoped state File chooser, OpenURI, print, inhibit, notifications, IME, accessibility
Bambu Studio Isolated Documents/Downloads/Pictures writable, app-scoped state X11/XWayland, PulseAudio, cloud/LAN network, file chooser, notifications, IME, accessibility
OrcaSlicer Isolated Documents/Downloads/Pictures writable, app-scoped state X11/XWayland, cloud/LAN network, file chooser, notifications, IME, accessibility
Remmina Isolated ~/.config/remmina, ~/.local/share/remmina, ~/.remmina, Downloads PulseAudio, SSH agent, file chooser, OpenURI, notifications, IME, accessibility
OBS Studio Isolated ~/.config/obs-studio, Videos/Pictures/Downloads ScreenCast, V4L2 camera (/dev/video0-1), PulseAudio, tray, notifications, IME, accessibility
Blender Isolated ~/.config/blender, Documents/Downloads/Pictures/Videos X11/XWayland, PulseAudio, notifications, IME, accessibility
MuseScore Isolated ~/.config/MuseScore, ~/.local/share/MuseScore, Documents/Downloads/Music/Pictures ALSA via PipeWire, ALSA sequencer, X11/XWayland, print, notifications, IME, accessibility
mpv Isolated ~/.config/mpv, ~/.cache/mpv, ~/.local/state/mpv; media dirs read-only MPRIS, file chooser, OpenURI
imv None $HOME read-only File chooser, OpenURI

All browsers get read-only NSS certificates, printing, native notifications and accessibility.

Browser secrets

  • Chromium family: app-scoped Secret portal only. SecretPortalKeyProviderUseForEncryption writes v12 cookies; no org.freedesktop.secrets or broad keyring access.
  • If the Secret portal is unavailable, Chromium can fall back to v10. Monitor Local State.os_crypt.portal.prev_init_success.
  • Firefox uses NSS: key4.db and logins.json for logins, cookies.sqlite for cookies. It has no Secret portal or keyring grant. A Primary Password protects saved logins, not cookies.
  • browserpass is separate: it exposes the password store and GPG-agent socket, not cookie encryption.
  • Bookmarks, history, localStorage, IndexedDB and extension data remain readable by the browser. nixpak isolates them from other apps, not from browser compromise.

Limits

  • X11: Zoom and WeChat have shared-display trust; portal permissions cannot enforce portal-only capture.
  • PulseAudio grants recording authority. Read-only GPG sockets still permit signing and decryption.
  • pasta isolates loopback, not LAN access. Chromecast discovery is unverified.
  • Brave Origin and Edge intentionally have no PulseAudio, Camera, ScreenCast or MPRIS grants. They are backup browsers, not media browsers.
  • FIDO2 passthrough: host udev rules hard-link only hidraw nodes whose report descriptor declares the FIDO usage page into /dev/fido-hidraw; the sandbox binds that directory plus read-only /sys/class/hidraw and the udev database. The CanoKey's KBD and CCID interfaces, other HID devices and raw USB stay outside, so the WebUSB console is unreachable by design (key policy). A compromised browser process can send raw CTAP to the key; the key's PIN and touch policy remain the authentication boundary. The read-only udev database exposes properties of all host devices, much of which is already readable via the sysfs device binds.
  • FIDO2 hotplug relies on udev events, which only reach the host network namespace. Firefox and Chromium therefore detect keys plugged in after launch; pasta-isolated Chrome needs the key present before launch. /dev/fido-hidraw is created at boot. When first deploying with switch instead of a reboot, run sudo systemd-tmpfiles --create --prefix=/dev/fido-hidraw, then replug the key (or sudo udevadm trigger --action=add -s hidraw) and fully restart the browsers: a browser started while the directory was missing has no bind for it.
  • Firefox camera and remote screen sharing are intentionally disabled. Firefox does not support the XDG Camera/ScreenCast portal path used here, so granting camera or screen-capture access would require widening the sandbox with raw /dev/video* or direct PipeWire access. We choose not to grant that privilege.
  • Bambu Studio's nixpkgs build omits the device_page frontend bundle, so filament management is unavailable. Its MakerWorld sidebar entry also requires the upstream firstguide.finish = "true" workaround; the startup splash may render black under XWayland.
  • Remmina's SSH Tunnel support receives a read-only SSH agent socket and SSH client config. A compromised Remmina can use the agent to sign or decrypt while the agent is running.
  • OBS, Blender, MuseScore and mpv use pasta-isolated networking. Host loopback services are not reachable unless the app is changed to a host-loopback exception.
  • MuseScore receives the raw PipeWire socket so its ALSA driver can use the host pcm.!default PipeWire plugin. PipeWire is a general media graph, so this is broader than a single audio stream: a compromised MuseScore could enumerate other user-visible PipeWire media nodes. The alternative, direct /dev/snd, confines the media graph but bypasses PipeWire device selection, per-app volume and mixing.
  • OBS on Linux defaults its recording path to $HOME. The sandbox intentionally binds only the declared home subdirectories, so recording output must target Videos, Pictures or Downloads; a file written to the home root exists only in the sandbox's transient mount namespace.

Validation

  • Passed: just fmt, just test, ai-niri build, shoukei-niri eval and all wrapper builds.
  • Interactive validation passed for Firefox, Chrome, Chromium, Brave Origin, Edge, QQ, Telegram, Zoom, Bambu Studio and OrcaSlicer. Chromium's host-loopback/personal-file exception and the Brave/Edge no-media policy are intentional.
  • OBS Studio passed interactive validation for PipeWire screen capture, V4L2 camera capture, desktop/microphone audio, local NVENC H.264 MP4 recording and local RTMP streaming. External provider authentication and browser sources remain unvalidated.
  • Remmina, Blender, mpv and imv build and pass the policy suite; interactive validation is still pending. MuseScore passed launch, XWayland and ALSA-to-PipeWire routing checks; audible playback and user workflows still need confirmation.
  • Chromium smoke test passed: renderer sandbox, environment clearing, bind scope, disposable-profile persistence and loopback policy.
  • FIDO2 browser passthrough is enabled for Firefox/Chromium/Chrome only. WebAuthn with the CanoKey passed in Firefox and Chrome; Chromium and plugging the key in after launch still need validation.
  • WeChat uses the native nixpkgs-master package with nixpak as the only bwrap layer. Build/policy pass; interactive Wayland validation is still pending.
  • Evidence and repeat commands: runtime validation, policy test, which auto-loads every suite under tests/policy.

Code map

Reference in new issue View Git Blame Copy Permalink