exozyme

exozyme/exozyme

Fork 1

Table of Contents

General tips
Sandboxing
Manually using user namespaces
Shell Script Security

Since the exozyme server is shared among many people, it's important to be mindful of security.

General tips

Use Unix sockets instead of TCP sockets whenever possible for web services, since anyone on the server can access your TCP socket. If you must use a TCP socket, you may want to password-protect the web service that's running on it.
Don't include secrets and passwords in command-line flags since they'll show up in the process table.

Sandboxing

Podman: Lightweight Linux containers similar to Docker. Use this if you don't know anything about sandboxing.

Bubblewrap

Use --unshare-all.
Use --ro-bind for the executable itself and files that it need to use, e.g. /usr/lib.
Use --bind for directories the service need to write to, e.g. /tmp. You only need this if the service has persistence.
Use --share-net if it needs network access. Unix domain sockets do not need this flag to function.

Manually using user namespaces

This section is for advanced users who know what they're doing. If you would like to run a command as a different user for security hardening, you can use this magic command: unshare -r --map-auto -S 1 -G 1.

Here's how it works. You have a set of 100000 subordinate users which are specified in /etc/subuid. They have UIDs starting with (your_UID-999)*100000.

When you run this unshare command, it maps UID 0 on the inside to your normal user and UIDs 1 through 100000 on the inside to your subordinate users on the outside. The flags -S 1 -G 1 specify that you would like to run the command on the inside as the UID 1 on the inside, which corresponds to your first subordinate user on the outside.

To chown files between your normal user and your subordinate users, use unshare -r --map-auto chown (unshare -r --map-auto is equivalent to podman unshare), and specify the inside UID of the target user.

Shell Script Security

Shell Scripts can be vulnerable if not written carefully.

Always use Shellcheck to scan for bugs.
For CGI Scripts consider using CGI Wrapper in your own http server such as Fastcgi, or caddy
Follow Principle of Least Privilege when it comes to permissions.
Dont Store Sensitive Information in scripts such as passwords.
Use Encrypted Passwords instead
Use Enviroment Variables Safely. eg. Set your $PATH carefully.

For Further Shell Script Security Practices check these resources: