Just a regular Joe.

  • 0 Posts
  • 105 Comments
Joined 1 year ago
cake
Cake day: July 7th, 2023

help-circle



  • I have two apparmor profiles targeting shell scripts, which can run other programs. One is “audit” (permissive with logging) and the other is “safe” (enforcing).

    The safe profile still has a lot of read access, but not to any directories or files with secrets or private data. Write access is only to the paths and files it needs, and I regularly extend it.

    For a specific program that should have very restricted network access, I have some iptables (& ip6tables) rules that only apply to a particular gid, and I have a setgid wrapper script.

    Note: This is all better than nothing, but proper segregation would be better. Running things on separate PCs, VMs or even unpriviliged containers.





  • NFSv3 (udp, stateless) was always as reliable as the network infra under Linux, I found. NFSv4 made things a bit more complicated.

    You don’t want any NAT / stateful connection tracking in the network path (anything that could hiccup and forget), and wired connections only for permanent storage mounts, of course.










  • It is possible to wrap something like python into a single file, which is extracted (using standard shell tools) into a tmpdir at runtime.

    You might also consider languages that can compile to static binaries - something like nim (python like syntax), although you could also make use of nimscript. Imagine nimscript as your own extensible interpreter.

    Similarly, golang has some extensible scripting languages like https://github.com/traefik/yaegi - go has the advantage of easy cross compiling if you need to support different machine architectures.



  • Joe@discuss.tchncs.detoMemes@lemmy.mlGlory!
    link
    fedilink
    arrow-up
    13
    arrow-down
    42
    ·
    edit-2
    4 months ago

    It’s the Y chromosome that triggers them.

    edit: alleged/unpublished … she failed some gender verification tests of IBA that disqualified her there, but met the IOC’s criteria. It is what it is. They might keep or change the eligibility rules in the future, and that will continue to be IOC’s decision, much as it is IBA’s.