mastodon 4.8.0-nightly.2026-10-10Homo Ludens. I push wood, set traps, write code and poetry. #sydbox is my problem child. I live in #Berlin. I am an #Exherbo #Linux developer. I love #chess, #freesoftware, #poetry, #perl, #c, #rustlang, and #haskell. #Antifa, #Atheist, #fckafd, and #fckakp. Don't come to me with guns, come to me with roses. #Revolution will not be broadcasted on TV. #direngezi!
https://chesswob.org
https://git.sr.ht/~alip/jja
https://sydbox.exherbolinux.org
#Sydbox is NOT hosted on #Github and this is an ethical decision. Main repository is the #Exherbo #Gitlab, we have mirrors on #Sourcehut and #Codeberg. Having said that, the code is GPL-3 and I can't legally prevent anyone from mirroring it on Github. I can just kindly ask not to...: https://github.com/tamaroning/sydbox/issues/1 #exherbo #linux #security
#gVisor recently got its own #ASLR implementation. OTOH, #Sydbox uses ASLR provided by the #Linux #kernel and enforces PIE executables. #HardenedBSD has a sysctl to enforce PIE as well: https://man.exherbo.org/syd.7.html#Enforcing_Position-Independent_Executables_(PIE) #exherbo #linux #security
New #Linux #LPE: #RefluXFS which is a direct attack against #XFS filesystem using the reflink feature giving #root access to unprivileged users by overwriting inaccessible data on #XFS filesystems. #Syd containers are not vulnerable because FICLONE{,RANGE} ioctls are denied by default with errno EOPNOTSUPP allowing cp --reflink to seamlessly fallback: https://cdn2.qualys.com/advisory/2026/07/22/RefluXFS.txt #exherbo #linux #security
Here is #rustlang bindings for Redis' #radix tree: https://crates.io/crates/redix New #sydbox uses this for path canonicalization which sufficiently reduces its userspace overhead. Let me know if sydbox-3.51.1 is too fast for you and I'll add some random sleeps around the code ;) #exherbo #linux #security
Code does not become better out of thin air just because you rewrite it in #rustlang. TOCTOUs are typically language agnostic. Here's one for tar: https://blog.rust-lang.org/2026/03/21/cve-2026-33056/ #security
#Sydbox 3.51.0 is out: #Security update fixing multiple Crypt Sandboxing race conditions, an ioctl(2) truncation bypass, and a MIPS ptrace(2) bug. Force Sandboxing now uses the Kernel Crypto API (AF_ALG) for zero-copy hashing. #Landlock sandboxing is on by default. wordexp(3) confinement hardened. pandora 0.20.0 generates #Landlock rules. Sydbox is a rock solid application #kernel to sandbox applications on #Linux: https://gitlab.exherbo.org/sydbox/sydbox/-/blob/main/ChangeLog.md?ref_type=heads#3510 #exherbo
unwrap is the new unsafe! #rustlang
Oh my snap! https://www.openwall.com/lists/oss-security/2026/03/17/8 A case of fortune favors the patient: "an unprivileged local attacker who wants to exploit this LPE must wait for 10 days (in Ubuntu > 24.04) or 30 days (in Ubuntu 24.04) to obtain a fully privileged root shell." This is why it matters to use unprivileged sandboxes such as #sydbox: Who's going to watch the watchers? #ubuntu #linux #security
News from #sydbox git: Force sandboxing (binary verification) now uses #Linux #kernel cryptography. You may use any hash algorithm your kernel supports and checksumming process happens with zero-copy without copying data into Syd's process space. This ensures performance and privacy. Syd is hash-algorithm agnostic and makes no choice of a default. Pandora learned to autoselect best avaliable algorithm. Refer to the manual page for more information: https://man.exherbo.org/syd.7.html#Force_Sandboxing #exherbo #security
#Sydbox 3.50.0 is out: New lock mode "drop" when sandbox policy may only be edited to reduce privileges a la #OpenBSD pledge(2), KCOV/syzkaller support, support for memfd_secret(2) and SCM_PIDFD control message, glob support for ioctl(2) names in sandbox rules (e.g. allow/ioctl+KVM_*), fix for a trusted symlink bypass, new trusted feature to gate unsafe options which can circumvent the sandbox. Sydbox is a rock solid application kernel to sandbox applications on #Linux: https://gitlab.exherbo.org/sydbox/sydbox/-/blob/main/ChangeLog.md?ref_type=heads#3500
"Seek #freedom and become captive of your desires, seek discipline and find your liberty." — Frank Herbert, Dune
Symbolic links bite again! This time it's #NixOS did you know #sydbox has trace/force_no_symlinks and trace/force_no_magiclinks options to disable following symlinks/magiclinks? You can even change them at runtime to achieve #pledge like confinement: https://discourse.nixos.org/t/nix-security-advisory-privilege-escalation-via-symlink-following-during-fod-output-registration/76900 #nix #linux #security
New hardening in #Sydbox 3.50.0: "Immutable Sticky Bit" where Syd enforces the immutability of the sticky bit at chmod(2) boundary for directories. Sticky bit on dirs such as /tmp is a critical security primitive that restricts file deletion/renaming to file/directory owner or root. This also helps raise the bar for trusted symlink bypasses. On by default, disable with trace/allow_unsafe_sticky:1. Refer to the manual page for more information: https://man.exherbo.org/syd.7.html#Immutable_Sticky_Bit #exherbo #linux #security
Am I a TOCTOU dreaming of a butterfly, or am I a butterfly dreaming of a TOCTOU?: https://git.kernel.org/pub/scm/libs/libcap/libcap.git/commit/?id=286ace1259992bd0c5d9016715833f2e148ac596 #exherbo #linux #security
Here is a #landlock oddity I noticed and reported today: https://github.com/landlock-lsm/linux/issues/58 #exherbo #linux #security
