add bwrap + age
This commit is contained in:
parent
c1d6c28dff
commit
323d59d281
GPG key ID:
901B2ADDF27C2263
3 changed files with 229 additions and 1 deletions
|
|
@ -1,6 +1,6 @@
|
||||||
---
|
---
|
||||||
obj: meta/collection
|
obj: meta/collection
|
||||||
rev: 2024-12-10
|
rev: 2025-01-09
|
||||||
---
|
---
|
||||||
|
|
||||||
# Applications
|
# Applications
|
||||||
|
|
@ -233,6 +233,7 @@ rev: 2024-12-10
|
||||||
- [yazi](./cli/yazi.md)
|
- [yazi](./cli/yazi.md)
|
||||||
- [GPG](../cryptography/GPG.md)
|
- [GPG](../cryptography/GPG.md)
|
||||||
- [OpenSSL](../cryptography/OpenSSL.md)
|
- [OpenSSL](../cryptography/OpenSSL.md)
|
||||||
|
- [age](../cryptography/age.md)
|
||||||
- [tomb](./cli/tomb.md)
|
- [tomb](./cli/tomb.md)
|
||||||
- [dysk](./cli/dysk.md)
|
- [dysk](./cli/dysk.md)
|
||||||
- [pass](./cli/pass.md)
|
- [pass](./cli/pass.md)
|
||||||
|
|
@ -252,6 +253,7 @@ rev: 2024-12-10
|
||||||
- [wine](../windows/Wine.md)
|
- [wine](../windows/Wine.md)
|
||||||
- [sbctl](../linux/sbctl.md)
|
- [sbctl](../linux/sbctl.md)
|
||||||
- [systemd-cryptenroll](../linux/systemd/systemd-cryptenroll.md)
|
- [systemd-cryptenroll](../linux/systemd/systemd-cryptenroll.md)
|
||||||
|
- [bubblewrap](./utilities/bubblewrap.md)
|
||||||
|
|
||||||
## Development
|
## Development
|
||||||
- [act](./development/act.md)
|
- [act](./development/act.md)
|
||||||
|
|
|
||||||
103
technology/applications/utilities/bubblewrap.md
Normal file
103
technology/applications/utilities/bubblewrap.md
Normal file
|
|
@ -0,0 +1,103 @@
|
||||||
|
---
|
||||||
|
obj: application
|
||||||
|
repo: https://github.com/containers/bubblewrap
|
||||||
|
arch-wiki: https://wiki.archlinux.org//title/Bubblewrap
|
||||||
|
rev: 2025-01-09
|
||||||
|
---
|
||||||
|
|
||||||
|
# Bubblewrap
|
||||||
|
Bubblewrap is a lightweight sandbox application used by Flatpak and other container tools. It has a small installation footprint and minimal resource requirements. Notable features include support for cgroup/IPC/mount/network/PID/user/UTS namespaces and seccomp filtering. Note that bubblewrap drops all capabilities within a sandbox and that child tasks cannot gain greater privileges than its parent.
|
||||||
|
|
||||||
|
## Configuration
|
||||||
|
Bubblewrap can be called directly from the command-line and/or within shell scripts as part of a complex wrapper.
|
||||||
|
|
||||||
|
A no-op bubblewrap invocation is as follows:
|
||||||
|
|
||||||
|
```sh
|
||||||
|
bwrap --dev-bind / / bash
|
||||||
|
```
|
||||||
|
|
||||||
|
This will spawn a Bash process which should behave exactly as outside a sandbox in most cases. If a sandboxed program misbehaves, you may want to start from the above no-op invocation, and work your way towards a more secure configuration step-by-step.
|
||||||
|
|
||||||
|
### Desktop entries
|
||||||
|
Leverage Bubblewrap within desktop entries:
|
||||||
|
- Bind as read-write the entire host `/` directory to `/` in the sandbox
|
||||||
|
- Re-bind as read-only the `/var` and `/etc` directories in the sandbox
|
||||||
|
- Mount a new devtmpfs filesystem to `/dev` in the sandbox
|
||||||
|
- Create a tmpfs filesystem over the sandboxed `/run` directory
|
||||||
|
- Disable network access by creating new network namespace
|
||||||
|
|
||||||
|
```ini
|
||||||
|
[Desktop Entry]
|
||||||
|
Name=nano Editor
|
||||||
|
Exec=bwrap --bind / / --dev /dev --tmpfs /run --unshare-net st -e nano -o . %f
|
||||||
|
Type=Application
|
||||||
|
MimeType=text/plain;
|
||||||
|
```
|
||||||
|
|
||||||
|
> **Note**: `--dev /dev` is required to write to `/dev/pty`
|
||||||
|
|
||||||
|
## Options
|
||||||
|
Usage: `bwrap [optiosn] [command]`
|
||||||
|
|
||||||
|
| Option | Description |
|
||||||
|
| ------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
|
||||||
|
| `--args FD` | Parse nul-separated arguments from the given file descriptor. This option can be used multiple times to parse options from multiple sources. |
|
||||||
|
| `--argv0 VALUE` | Set `argv[0]` to the value VALUE before running the program |
|
||||||
|
| `--unshare-user` | Create a new user namespace |
|
||||||
|
| `--unshare-user-try` | Create a new user namespace if possible else skip it |
|
||||||
|
| `--unshare-ipc` | Create a new ipc namespace |
|
||||||
|
| `--unshare-pid` | Create a new pid namespace |
|
||||||
|
| `--unshare-net` | Create a new network namespace |
|
||||||
|
| `--unshare-uts` | Create a new uts namespace |
|
||||||
|
| `--unshare-cgroup` | Create a new cgroup namespace |
|
||||||
|
| `--unshare-cgroup-try` | Create a new cgroup namespace if possible else skip it |
|
||||||
|
| `--unshare-all` | Unshare all possible namespaces. Currently equivalent with: `--unshare-user-try --unshare-ipc --unshare-pid --unshare-net --unshare-uts --unshare-cgroup-try` |
|
||||||
|
| `--share-net` | Retain the network namespace, overriding an earlier `--unshare-all` or `--unshare-net` |
|
||||||
|
| `--userns FD` | Use an existing user namespace instead of creating a new one. The namespace must fulfil the permission requirements for `setns()`, which generally means that it must be a descendant of the currently active user namespace, owned by the same user. |
|
||||||
|
| `--disable-userns` | Prevent the process in the sandbox from creating further user namespaces, so that it cannot rearrange the filesystem namespace or do other more complex namespace modification. |
|
||||||
|
| `--assert-userns-disabled` | Confirm that the process in the sandbox has been prevented from creating further user namespaces, but without taking any particular action to prevent that. For example, this can be combined with --userns to check that the given user namespace has already been set up to prevent the creation of further user namespaces. |
|
||||||
|
| `--pidns FD` | Use an existing pid namespace instead of creating one. This is often used with `--userns`, because the pid namespace must be owned by the same user namespace that bwrap uses. |
|
||||||
|
| `--uid UID` | Use a custom user id in the sandbox (requires `--unshare-user`) |
|
||||||
|
| `--gid GID` | Use a custom group id in the sandbox (requires `--unshare-user`) |
|
||||||
|
| `--hostname HOSTNAME` | Use a custom hostname in the sandbox (requires `--unshare-uts`) |
|
||||||
|
| `--chdir DIR` | Change directory to DIR |
|
||||||
|
| `--setenv VAR VALUE` | Set an environment variable |
|
||||||
|
| `--unsetenv VAR` | Unset an environment variable |
|
||||||
|
| `--clearenv` | Unset all environment variables, except for PWD and any that are subsequently set by `--setenv` |
|
||||||
|
| `--lock-file DEST` | Take a lock on DEST while the sandbox is running. This option can be used multiple times to take locks on multiple files. |
|
||||||
|
| `--sync-fd FD` | Keep this file descriptor open while the sandbox is running |
|
||||||
|
| `--perms OCTAL` | This option does nothing on its own, and must be followed by one of the options that it affects. It sets the permissions for the next operation to OCTAL. Subsequent operations are not affected: for example, `--perms 0700 --tmpfs /a --tmpfs /b` will mount `/a` with permissions `0700`, then return to the default permissions for `/b`. Note that `--perms` and `--size` can be combined: `--perms 0700 --size 10485760 --tmpfs /s` will apply permissions as well as a maximum size to the created tmpfs. |
|
||||||
|
| `--size BYTES` | This option does nothing on its own, and must be followed by `--tmpfs`. It sets the size in bytes for the next tmpfs. For example, `--size 10485760 --tmpfs /tmp` will create a tmpfs at `/tmp` of size 10MiB. Subsequent operations are not affected. |
|
||||||
|
| `--bind SRC DEST` | Bind mount the host path SRC on DEST |
|
||||||
|
| `--bind-try SRC DEST` | Equal to `--bind` but ignores non-existent SRC |
|
||||||
|
| `--dev-bind SRC DEST` | Bind mount the host path SRC on DEST, allowing device access |
|
||||||
|
| `--dev-bind-try SRC DEST` | Equal to `--dev-bind` but ignores non-existent SRC |
|
||||||
|
| `--ro-bind SRC DEST` | Bind mount the host path SRC readonly on DEST |
|
||||||
|
| `--ro-bind-try SRC DEST` | Equal to `--ro-bind` but ignores non-existent SRC |
|
||||||
|
| `--remount-ro DEST` | Remount the path DEST as readonly. It works only on the specified mount point, without changing any other mount point under the specified path |
|
||||||
|
| `--overlay-src SRC` | This option does nothing on its own, and must be followed by one of the other overlay options. It specifies a host path from which files should be read if they aren't present in a higher layer. |
|
||||||
|
| `--overlay RWSRC WORKDIR DEST`, `--tmp-overlay DEST`, `--ro-overlay DEST` | Use overlayfs to mount the host paths specified by `RWSRC` and all immediately preceding `--overlay-src` on `DEST`. `DEST` will contain the union of all the files in all the layers. With `--overlay` all writes will go to `RWSRC`. Reads will come preferentially from `RWSRC`, and then from any `--overlay-src` paths. `WORKDIR` must be an empty directory on the same filesystem as `RWSRC`, and is used internally by the kernel. With `--tmp-overlay` all writes will go to the tmpfs that hosts the sandbox root, in a location not accessible from either the host or the child process. Writes will therefore not be persisted across multiple runs. With `--ro-overlay` the filesystem will be mounted read-only. This option requires at least two `--overlay-src` to precede it. |
|
||||||
|
| `--proc DEST` | Mount procfs on DEST |
|
||||||
|
| `--dev DEST` | Mount new devtmpfs on DEST |
|
||||||
|
| `--tmpfs DEST` | Mount new tmpfs on DEST. If the previous option was `--perms`, it sets the mode of the tmpfs. Otherwise, the tmpfs has mode `0755`. If the previous option was `--size`, it sets the size in bytes of the tmpfs. Otherwise, the tmpfs has the default size. |
|
||||||
|
| `--mqueue DEST` | Mount new mqueue on DEST |
|
||||||
|
| `--dir DEST` | Create a directory at DEST. If the directory already exists, its permissions are unmodified, ignoring `--perms` (use `--chmod` if the permissions of an existing directory need to be changed). If the directory is newly created and the previous option was `--perms`, it sets the mode of the directory. Otherwise, newly-created directories have mode `0755`. |
|
||||||
|
| `--file FD DEST` | Copy from the file descriptor FD to DEST. If the previous option was `--perms`, it sets the mode of the new file. Otherwise, the file has mode `0666` (note that this is not the same as `--bind-data`). |
|
||||||
|
| `--bind-data FD DEST` | Copy from the file descriptor FD to a file which is bind-mounted on DEST. If the previous option was `--perms`, it sets the mode of the new file. Otherwise, the file has mode `0600` (note that this is not the same as `--file`). |
|
||||||
|
| `--ro-bind-data FD DEST` | Copy from the file descriptor FD to a file which is bind-mounted read-only on DEST. If the previous option was `--perms`, it sets the mode of the new file. Otherwise, the file has mode `0600` (note that this is not the same as `--file`). |
|
||||||
|
| `--symlink SRC DEST` | Create a symlink at DEST with target SRC. |
|
||||||
|
| `--chmod OCTAL PATH` | Set the permissions of PATH, which must already exist, to OCTAL. |
|
||||||
|
| `--seccomp FD` | Load and use seccomp rules from FD. The rules need to be in the form of a compiled cBPF program, as generated by seccomp_export_bpf. If this option is given more than once, only the last one is used. Use `--add-seccomp-fd` if multiple seccomp programs are needed. |
|
||||||
|
| `--add-seccomp-fd FD` | Load and use seccomp rules from FD. The rules need to be in the form of a compiled cBPF program, as generated by seccomp_export_bpf. This option can be repeated, in which case all the seccomp programs will be loaded in the order given (note that the kernel will evaluate them in reverse order, so the last program on the bwrap command-line is evaluated first). All of them, except possibly the last, must allow use of the PR_SET_SECCOMP prctl. This option cannot be combined with `--seccomp`. |
|
||||||
|
| `--exec-label LABEL` | Exec Label from the sandbox. On an SELinux system you can specify the SELinux context for the sandbox process(s). |
|
||||||
|
| `--file-label LABEL` | File label for temporary sandbox content. On an SELinux system you can specify the SELinux context for the sandbox content. |
|
||||||
|
| `--block-fd FD` | Block the sandbox on reading from FD until some data is available. |
|
||||||
|
| `--userns-block-fd FD` | Do not initialize the user namespace but wait on FD until it is ready. This allow external processes (like newuidmap/newgidmap) to setup the user namespace before it is used by the sandbox process. |
|
||||||
|
| `--info-fd FD` | Write information in JSON format about the sandbox to FD. |
|
||||||
|
| `--json-status-fd FD` | Multiple JSON documents are written to FD, one per line. |
|
||||||
|
| `--new-session` | Create a new terminal session for the sandbox (calls `setsid()`). This disconnects the sandbox from the controlling terminal which means the sandbox can't for instance inject input into the terminal. Note: In a general sandbox, if you don't use `--new-session`, it is recommended to use seccomp to disallow the `TIOCSTI` ioctl, otherwise the application can feed keyboard input to the terminal which can e.g. lead to out-of-sandbox command execution. |
|
||||||
|
| `--die-with-parent` | Ensures child process (COMMAND) dies when bwrap's parent dies. Kills (SIGKILL) all bwrap sandbox processes in sequence from parent to child including COMMAND process when bwrap or bwrap's parent dies. |
|
||||||
|
| `--as-pid-1` | Do not create a process with PID=1 in the sandbox to reap child processes. |
|
||||||
|
| `--cap-add CAP` | Add the specified capability CAP, e.g. `CAP_DAC_READ_SEARCH`, when running as privileged user. It accepts the special value `ALL` to add all the permitted caps. |
|
||||||
|
| `--cap-drop CAP` | Drop the specified capability when running as privileged user. It accepts the special value `ALL` to drop all the caps. By default no caps are left in the sandboxed process. The `--cap-add` and `--cap-drop` options are processed in the order they are specified on the command line. Please be careful to the order they are specified. |
|
||||||
123
technology/cryptography/age.md
Normal file
123
technology/cryptography/age.md
Normal file
|
|
@ -0,0 +1,123 @@
|
||||||
|
---
|
||||||
|
obj: application
|
||||||
|
repo: https://github.com/FiloSottile/age
|
||||||
|
source: https://age-encryption.org/v1
|
||||||
|
rev: 2025-01-09
|
||||||
|
---
|
||||||
|
|
||||||
|
# age
|
||||||
|
age is a simple, modern and secure file encryption tool, format, and Go library.
|
||||||
|
|
||||||
|
It features small explicit keys, no config options, and UNIX-style composability.
|
||||||
|
|
||||||
|
```sh
|
||||||
|
$ age-keygen -o key.txt
|
||||||
|
Public key: age1ql3z7hjy54pw3hyww5ayyfg7zqgvc7w3j2elw8zmrj2kg5sfn9aqmcac8p
|
||||||
|
$ PUBLIC_KEY=$(age-keygen -y key.txt)
|
||||||
|
$ tar cvz ~/data | age -r $PUBLIC_KEY > data.tar.gz.age
|
||||||
|
$ age --decrypt -i key.txt data.tar.gz.age > data.tar.gz
|
||||||
|
```
|
||||||
|
|
||||||
|
## Usage
|
||||||
|
For the full documentation, read [the age(1) man page](https://filippo.io/age/age.1).
|
||||||
|
|
||||||
|
```
|
||||||
|
Usage:
|
||||||
|
age [--encrypt] (-r RECIPIENT | -R PATH)... [--armor] [-o OUTPUT] [INPUT]
|
||||||
|
age [--encrypt] --passphrase [--armor] [-o OUTPUT] [INPUT]
|
||||||
|
age --decrypt [-i PATH]... [-o OUTPUT] [INPUT]
|
||||||
|
|
||||||
|
Options:
|
||||||
|
-e, --encrypt Encrypt the input to the output. Default if omitted.
|
||||||
|
-d, --decrypt Decrypt the input to the output.
|
||||||
|
-o, --output OUTPUT Write the result to the file at path OUTPUT.
|
||||||
|
-a, --armor Encrypt to a PEM encoded format.
|
||||||
|
-p, --passphrase Encrypt with a passphrase.
|
||||||
|
-r, --recipient RECIPIENT Encrypt to the specified RECIPIENT. Can be repeated.
|
||||||
|
-R, --recipients-file PATH Encrypt to recipients listed at PATH. Can be repeated.
|
||||||
|
-i, --identity PATH Use the identity file at PATH. Can be repeated.
|
||||||
|
|
||||||
|
INPUT defaults to standard input, and OUTPUT defaults to standard output.
|
||||||
|
If OUTPUT exists, it will be overwritten.
|
||||||
|
|
||||||
|
RECIPIENT can be an age public key generated by age-keygen ("age1...")
|
||||||
|
or an SSH public key ("ssh-ed25519 AAAA...", "ssh-rsa AAAA...").
|
||||||
|
|
||||||
|
Recipient files contain one or more recipients, one per line. Empty lines
|
||||||
|
and lines starting with "#" are ignored as comments. "-" may be used to
|
||||||
|
read recipients from standard input.
|
||||||
|
|
||||||
|
Identity files contain one or more secret keys ("AGE-SECRET-KEY-1..."),
|
||||||
|
one per line, or an SSH key. Empty lines and lines starting with "#" are
|
||||||
|
ignored as comments. Passphrase encrypted age files can be used as
|
||||||
|
identity files. Multiple key files can be provided, and any unused ones
|
||||||
|
will be ignored. "-" may be used to read identities from standard input.
|
||||||
|
|
||||||
|
When --encrypt is specified explicitly, -i can also be used to encrypt to an
|
||||||
|
identity file symmetrically, instead or in addition to normal recipients.
|
||||||
|
```
|
||||||
|
|
||||||
|
### Multiple recipients
|
||||||
|
Files can be encrypted to multiple recipients by repeating `-r/--recipient`. Every recipient will be able to decrypt the file.
|
||||||
|
|
||||||
|
```
|
||||||
|
$ age -o example.jpg.age -r age1ql3z7hjy54pw3hyww5ayyfg7zqgvc7w3j2elw8zmrj2kg5sfn9aqmcac8p \
|
||||||
|
-r age1lggyhqrw2nlhcxprm67z43rta597azn8gknawjehu9d9dl0jq3yqqvfafg example.jpg
|
||||||
|
```
|
||||||
|
|
||||||
|
#### Recipient files
|
||||||
|
Multiple recipients can also be listed one per line in one or more files passed with the `-R/--recipients-file` flag.
|
||||||
|
|
||||||
|
```
|
||||||
|
$ cat recipients.txt
|
||||||
|
# Alice
|
||||||
|
age1ql3z7hjy54pw3hyww5ayyfg7zqgvc7w3j2elw8zmrj2kg5sfn9aqmcac8p
|
||||||
|
# Bob
|
||||||
|
age1lggyhqrw2nlhcxprm67z43rta597azn8gknawjehu9d9dl0jq3yqqvfafg
|
||||||
|
$ age -R recipients.txt example.jpg > example.jpg.age
|
||||||
|
```
|
||||||
|
|
||||||
|
If the argument to `-R` (or `-i`) is `-`, the file is read from standard input.
|
||||||
|
|
||||||
|
### Passphrases
|
||||||
|
Files can be encrypted with a passphrase by using `-p/--passphrase`. By default age will automatically generate a secure passphrase. Passphrase protected files are automatically detected at decrypt time.
|
||||||
|
|
||||||
|
```
|
||||||
|
$ age -p secrets.txt > secrets.txt.age
|
||||||
|
Enter passphrase (leave empty to autogenerate a secure one):
|
||||||
|
Using the autogenerated passphrase "release-response-step-brand-wrap-ankle-pair-unusual-sword-train".
|
||||||
|
$ age -d secrets.txt.age > secrets.txt
|
||||||
|
Enter passphrase:
|
||||||
|
```
|
||||||
|
|
||||||
|
### Passphrase-protected key files
|
||||||
|
If an identity file passed to `-i` is a passphrase encrypted age file, it will be automatically decrypted.
|
||||||
|
|
||||||
|
```
|
||||||
|
$ age-keygen | age -p > key.age
|
||||||
|
Public key: age1yhm4gctwfmrpz87tdslm550wrx6m79y9f2hdzt0lndjnehwj0ukqrjpyx5
|
||||||
|
Enter passphrase (leave empty to autogenerate a secure one):
|
||||||
|
Using the autogenerated passphrase "hip-roast-boring-snake-mention-east-wasp-honey-input-actress".
|
||||||
|
$ age -r age1yhm4gctwfmrpz87tdslm550wrx6m79y9f2hdzt0lndjnehwj0ukqrjpyx5 secrets.txt > secrets.txt.age
|
||||||
|
$ age -d -i key.age secrets.txt.age > secrets.txt
|
||||||
|
Enter passphrase for identity file "key.age":
|
||||||
|
```
|
||||||
|
|
||||||
|
Passphrase-protected identity files are not necessary for most use cases, where access to the encrypted identity file implies access to the whole system. However, they can be useful if the identity file is stored remotely.
|
||||||
|
|
||||||
|
### SSH keys
|
||||||
|
As a convenience feature, age also supports encrypting to `ssh-rsa` and `ssh-ed25519` SSH public keys, and decrypting with the respective private key file. (`ssh-agent` is not supported.)
|
||||||
|
|
||||||
|
```
|
||||||
|
$ age -R ~/.ssh/id_ed25519.pub example.jpg > example.jpg.age
|
||||||
|
$ age -d -i ~/.ssh/id_ed25519 example.jpg.age > example.jpg
|
||||||
|
```
|
||||||
|
|
||||||
|
Note that SSH key support employs more complex cryptography, and embeds a public key tag in the encrypted file, making it possible to track files that are encrypted to a specific public key.
|
||||||
|
|
||||||
|
#### Encrypting to a GitHub user
|
||||||
|
Combining SSH key support and `-R`, you can easily encrypt a file to the SSH keys listed on a GitHub profile.
|
||||||
|
|
||||||
|
```
|
||||||
|
$ curl https://github.com/benjojo.keys | age -R - example.jpg > example.jpg.age
|
||||||
|
```
|
||||||
Loading…
Add table
Reference in a new issue