Commits on Mar 18, 2024

1. systemd: tight sandboxing …

   wireproxy needs very little permissions, we can restrict it to basically
   nothing. DynamicUser means the system will generate a UID on demand
   for service, also CAP_NET_BIND_SERVICE can be used to allow this user
   to bind to a port < 1024 if desired. Also LoadCredential lets us read
   a file with tight permissions i.e. root:root 0400 and pass it to only
   wireproxy in an ephemeral and constrained manner.
   
   Signed-off-by: J. Dekker <[email protected]>

   

   jdek committed Mar 18, 2024
   Configuration menu

   • View commit details
   • Copy full SHA for 47b8778
   • Browse repository at this point

   Copy the full SHA

   47b8778 View commit details

   Browse the repository at this point in the history