starred/nix-config
1
0 Fork 0
mirror of https://github.com/ryan4yin/nix-config.git synced 2026-11-13 12:13:46 +01:00
Code Issues Packages Projects Releases 10 Wiki Activity
Files
7a00fead7db82b1df173e6e1d3c3d1c6cac0f3a3
nix-config/hardening/README.md
T
Ryan Yin 87b7a23cf3 docs(nixpak): consolidate runtime validation notes 
Merge the three runtime-validation files into one concise record, update the interactive browser and Zoom results, and document the intentional Chromium host-loopback and Brave/Edge no-media exceptions. Tighten the remaining cookie-crypto workaround and the smoke-test prerequisites.

Assisted-by: DeepSeek Harness (deepseek-flash)
2026-11-01 09:24:23 +08:00

5.9 KiB
Raw Blame History

Linux Hardening

Deployed and interactively validated on the Linux desktop host (2026-10-31). Policy and limits: SECURITY.md.

Shared boundaries

  • Cleared environment; filtered session D-Bus; private /dev/shm; per-app /tmp. Chromium-family browsers share an app-specific /tmp so external URLs reuse one browser instance.
  • Read-only /nix/store; GPU and display; fonts and themes; LAN and Internet.
  • Portals for file chooser, URI opening, notifications, input methods and document exports.
  • No whole host home, system D-Bus, SSH agent, USB/serial, raw camera or raw PipeWire socket.
  • Host loopback only for Firefox/Chromium; all other apps use pasta-isolated loopback. Chromium is an intentional development exception. Brave Origin and Edge are backup browsers and receive no media grants.

App permissions

Media means audio playback, microphone, Camera and ScreenCast portals. Writable paths are listed explicitly; other files use the document portal. Every app also has private writable state.

App Network Writable paths Grants
Firefox Host loopback ~/.mozilla, personal files, Trash, Firefox artwork Media, browserpass, MPRIS, idle
Chromium Host loopback ~/.config/chromium, personal files Media, browserpass, MPRIS, idle, v12 Secret
Chrome Isolated ~/.config/google-chrome, Downloads Media, browserpass, MPRIS, idle, v12 Secret
Brave Origin Isolated ~/.config/BraveSoftware/Brave-Origin, Downloads v12 Secret
Edge Isolated ~/.config/microsoft-edge, Downloads v12 Secret
QQ Isolated Personal files, private app state Media, notifications, tray, MPRIS, idle, accessibility
Telegram Isolated Personal files, private app state Media, notifications, tray, MPRIS, idle, accessibility, Ayatana indicators
Zoom Isolated ~/.zoom, zoomus.conf, zoom.conf, Downloads, Documents/Zoom, private app state Media, X11/XWayland, FHS, SNI tray, idle, /dev/video0-1, read-only /sys/class/drm
WeChat Isolated Documents, Downloads, app-scoped wechat data, private app state Media, Wayland, X11 fallback, SNI tray, file chooser portal

All browsers get read-only NSS certificates, printing, native notifications and accessibility.

Browser secrets

  • Chromium family: app-scoped Secret portal only. SecretPortalKeyProviderUseForEncryption writes v12 cookies; no org.freedesktop.secrets or broad keyring access.
  • If the Secret portal is unavailable, Chromium can fall back to v10. Monitor Local State.os_crypt.portal.prev_init_success.
  • Firefox uses NSS: key4.db and logins.json for logins, cookies.sqlite for cookies. It has no Secret portal or keyring grant. A Primary Password protects saved logins, not cookies.
  • browserpass is separate: it exposes the password store and GPG-agent socket, not cookie encryption.
  • Bookmarks, history, localStorage, IndexedDB and extension data remain readable by the browser. nixpak isolates them from other apps, not from browser compromise.

Limits

  • X11: Zoom and WeChat have shared-display trust; portal permissions cannot enforce portal-only capture.
  • PulseAudio grants recording authority. Read-only GPG sockets still permit signing and decryption.
  • pasta isolates loopback, not LAN access. Chromecast discovery is unverified.
  • Brave Origin and Edge intentionally have no PulseAudio, Camera, ScreenCast or MPRIS grants. They are backup browsers, not media browsers.

Validation

  • Passed: just fmt, just test, ai-niri build, shoukei-niri eval and all wrapper builds.
  • Interactive validation passed for Firefox, Chrome, Chromium, Brave Origin, Edge, QQ, Telegram and Zoom. Chromium's host-loopback/personal-file exception and the Brave/Edge no-media policy are intentional.
  • Chromium smoke test passed: renderer sandbox, environment clearing, bind scope, disposable-profile persistence and loopback policy.
  • WeChat uses the native nixpkgs-patched package with nixpak as the only bwrap layer. Build/policy pass; interactive Wayland validation is still pending.
  • Evidence and repeat commands: runtime validation, policy test.

Code map

Reference in new issue View Git Blame Copy Permalink