432e2b825e
Installed the .deb on the live server. The daemon did not start, and everything below is what that one command surfaced. 1. MemoryDenyWriteExecute=yes stopped the service dead. yara-x compiles rules to WebAssembly and JITs them, so it needs pages that go writable then executable. With W^X enforced the daemon aborts at startup: "unable to make memory executable". The unit had passed systemd-analyze verify, which checks syntax and cannot know this. Now off, with the reasoning in the unit rather than in a commit nobody will read: a hardening directive that stops the service is worse than the exposure it prevents, because the machine ends up with no antivirus at all. What compensates is spelled out beside it. 2. Hound detected itself. The goodware gate reported /usr/bin/houndd as Linux.Coinminer.XMRig and Linux.Rootkit.Preload. Correctly: the built-in pack matches on "stratum+tcp://", "xmrig", "RTLD_NEXT" and "ld.so.preload", and the pack was embedded verbatim, so the daemon's own binary contained all of them. Not cosmetic. With the execution gate armed, Hound would have refused to execute itself or quarantined its own binary — a scanner that eats its own daemon the moment protection is switched on. The pack is now XOR-masked at build time (build.rs) and unmasked at startup. Not a secret — the rules are open source — the only job is keeping the literal bytes out of the executable. Two regression tests: the embedded blob carries no plaintext rule strings, and a built daemon binary in target/ carries none either. 3. The postinst copied the built-in pack into /var/lib/hound/rules, where the daemon compiled it a second time and logged a duplicate declaration on every start. That directory is for ADDITIONAL packs; the built-ins live in the binary. Removed from deb, rpm and AUR. 4. The daemon and the CLI disagreed about the socket. systemd gives the service /run/hound; the CLI looked in $XDG_RUNTIME_DIR and reported the daemon unreachable — technically true, entirely unhelpful. default_socket_path() now prefers /run/hound when it exists, the unit states HOUNDD_SOCK explicitly, and a permission error on the socket says "try: sudo hound" instead of "Permission denied". Also: Recommends: clamav-daemon was wrong and apt duly installed clamd, which took 970 MB of RSS on the live server. clamd is an optional arm's-length engine, so it is a Suggests. I stopped and disabled the copy my install pulled in. Verified on the server after fixing: service active, status reports the engine and the gate, EICAR caught, rootkit scan clean, and the goodware gate passes across 3,955 system binaries including the now-installed houndd. The gate remains OFF. Turning it on for the host that serves Caddy is a separate decision. 295 tests pass. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
69 lines
2.3 KiB
RPMSpec
69 lines
2.3 KiB
RPMSpec
Name: hound
|
|
Version: 0.1.0
|
|
Release: 1%{?dist}
|
|
Summary: Hound Antivirus for Linux
|
|
License: Apache-2.0
|
|
URL: https://houndav.com
|
|
Source0: %{name}-%{version}.tar.gz
|
|
BuildRequires: rust >= 1.91, cargo, systemd-rpm-macros
|
|
Requires: systemd
|
|
Suggests: clamd
|
|
|
|
%description
|
|
Endpoint and supply-chain protection built for the distributions people
|
|
actually run. Scanning is yara-x in process; real-time protection uses
|
|
fanotify, so a binary can be refused at execve rather than reported after
|
|
it has already run.
|
|
|
|
The execution gate is installed switched OFF. It needs CAP_SYS_ADMIN and
|
|
covers the whole root filesystem, so enabling it is the operator's call:
|
|
hound settings set exec_gate true
|
|
|
|
%prep
|
|
%autosetup
|
|
|
|
%build
|
|
cargo build --release -p houndd -p hound
|
|
|
|
%install
|
|
install -Dm755 target/release/houndd %{buildroot}%{_bindir}/houndd
|
|
install -Dm755 target/release/hound %{buildroot}%{_bindir}/hound
|
|
install -Dm644 packaging/systemd/houndd.service \
|
|
%{buildroot}%{_unitdir}/houndd.service
|
|
install -Dm644 crates/houndd/rules/hound-builtin.yar \
|
|
%{buildroot}%{_datadir}/hound/rules/hound-builtin.yar
|
|
install -dm755 %{buildroot}%{_sharedstatedir}/hound/rules
|
|
install -dm700 %{buildroot}%{_sharedstatedir}/hound/vault
|
|
for s in 16 22 24 32 48 64 128 256 512; do
|
|
install -Dm644 assets/icons/app-${s}.png \
|
|
%{buildroot}%{_datadir}/icons/hicolor/${s}x${s}/apps/hound.png
|
|
done
|
|
install -Dm644 assets/icons/hound-app.svg \
|
|
%{buildroot}%{_datadir}/icons/hicolor/scalable/apps/hound.svg
|
|
|
|
%post
|
|
# The built-in rules are compiled into the binary; %{_sharedstatedir}/hound/rules
|
|
# is for additional packs only. Seeding it there compiles them twice.
|
|
%systemd_post houndd.service
|
|
|
|
%preun
|
|
%systemd_preun houndd.service
|
|
|
|
%postun
|
|
%systemd_postun_with_restart houndd.service
|
|
|
|
%files
|
|
%{_bindir}/houndd
|
|
%{_bindir}/hound
|
|
%{_unitdir}/houndd.service
|
|
%{_datadir}/hound/rules/hound-builtin.yar
|
|
%{_datadir}/icons/hicolor/*/apps/hound.png
|
|
%{_datadir}/icons/hicolor/scalable/apps/hound.svg
|
|
%dir %{_sharedstatedir}/hound
|
|
%dir %{_sharedstatedir}/hound/rules
|
|
# The vault holds live malware: root-only, never world-readable.
|
|
%attr(0700,root,root) %dir %{_sharedstatedir}/hound/vault
|
|
|
|
%changelog
|
|
* Fri Aug 21 2026 Hound <support@houndav.com> - 0.1.0-1
|
|
- yara-x engine in process; fanotify execution gate
|