6016e1b4ea
Phase 2. "Distro-agnostic" was a claim with no packaging behind it. .deb and AppImage are both built and tested here; the rpm spec and PKGBUILD are written but not yet built, since neither rpmbuild nor makepkg exists on this machine. The AppImage is deliberately not a packaged daemon. An AppImage is unprivileged by design — no install, no root, no systemd — so the execution gate cannot exist in one, and pretending otherwise would be worse than saying so. What it is instead is the try-before-you-install build: on-demand scanning, quarantine under the user's own data dir, rootkit and supply-chain checks, all with nothing left behind. Asking it for the gate prints why it cannot and how to get it. Verified with an isolated HOME: status, scan, EICAR caught, gate refusal. Two packaging bugs caught by looking rather than assuming: * mktemp -d creates 0700 and dpkg applies the staging root's mode to "/". Installing that package would have chmodded the root directory to 0700 and broken the machine. * AppRun wrote its log before creating the directory, and built a socket path that can exceed sun_path (108 bytes) when XDG_RUNTIME_DIR is long. Both fixed; the socket falls back rather than failing with an error nobody can act on. The systemd unit is hardened as far as this daemon can be. Notably ProtectSystem=strict is WRONG here and is left off on purpose: it remounts everything read-only, and quarantine has to remove a threat from wherever it landed. ProtectHome is off for the same reason. The CapabilityBoundingSet mirrors what caps.rs drops to, so the machine is protected even if the binary is replaced by one that does not reduce itself. App icon: the mark in white on a periwinkle tile, per Joe. Small sizes are not the same artwork scaled down — the mark is line-weight, so at 16px a 62% inset leaves about a pixel and a half of stroke and the head turns to mush. Each size is authored with its own inset and corner radius, and the ground goes flat below 32px because a gradient across 16 pixels is just noise. The tray ladder is untouched: those glyphs stay transparent and re-tint per state so they can sit on any panel colour. Package installs are NOT enabled by default beyond the daemon itself — exec_gate stays off until the operator turns it on, in every packaging format. 99 tests pass. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
70 lines
2.7 KiB
Desktop File
70 lines
2.7 KiB
Desktop File
[Unit]
|
|
Description=Hound Antivirus daemon
|
|
Documentation=https://houndav.com/docs
|
|
After=network.target
|
|
# The gate is only useful while the filesystem it watches is mounted.
|
|
RequiresMountsFor=/var/lib/hound
|
|
|
|
[Service]
|
|
Type=exec
|
|
ExecStart=/usr/bin/houndd
|
|
Restart=on-failure
|
|
RestartSec=2s
|
|
|
|
# ── Privilege ────────────────────────────────────────────────────────
|
|
#
|
|
# houndd reduces its own capabilities at startup (see crates/houndd/src/
|
|
# caps.rs). This bounding set is the second half of that: it protects the
|
|
# machine if the binary is ever replaced by one that does not, and it
|
|
# means the daemon never *holds* the rest even momentarily.
|
|
#
|
|
# It cannot be narrower. fanotify needs SYS_ADMIN; scanning arbitrary
|
|
# files needs DAC_READ_SEARCH; quarantining out of a directory owned by
|
|
# someone else needs DAC_OVERRIDE; stripping the execute bit off a file
|
|
# we do not own needs FOWNER.
|
|
CapabilityBoundingSet=CAP_SYS_ADMIN CAP_DAC_READ_SEARCH CAP_DAC_OVERRIDE CAP_FOWNER
|
|
AmbientCapabilities=CAP_SYS_ADMIN CAP_DAC_READ_SEARCH CAP_DAC_OVERRIDE CAP_FOWNER
|
|
NoNewPrivileges=yes
|
|
|
|
# ── Filesystem ───────────────────────────────────────────────────────
|
|
#
|
|
# ProtectSystem=strict would be the obvious choice and is WRONG here: it
|
|
# remounts everything read-only, and quarantine has to remove a threat
|
|
# from wherever it landed. ProtectHome is off for the same reason — most
|
|
# of what we quarantine is under /home.
|
|
ProtectSystem=false
|
|
ProtectHome=false
|
|
ReadWritePaths=/var/lib/hound /var/log/hound
|
|
StateDirectory=hound
|
|
LogsDirectory=hound
|
|
RuntimeDirectory=hound
|
|
PrivateTmp=no
|
|
|
|
# ── Everything else we can shut off ──────────────────────────────────
|
|
ProtectKernelTunables=yes
|
|
ProtectKernelModules=yes
|
|
ProtectKernelLogs=yes
|
|
ProtectControlGroups=yes
|
|
ProtectClock=yes
|
|
ProtectHostname=yes
|
|
ProtectProc=invisible
|
|
RestrictNamespaces=yes
|
|
RestrictRealtime=yes
|
|
RestrictSUIDSGID=yes
|
|
LockPersonality=yes
|
|
MemoryDenyWriteExecute=yes
|
|
RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
|
|
SystemCallArchitectures=native
|
|
SystemCallFilter=@system-service
|
|
SystemCallFilter=~@clock @cpu-emulation @debug @module @mount @obsolete @raw-io @reboot @swap
|
|
UMask=0077
|
|
|
|
# ── Resources ────────────────────────────────────────────────────────
|
|
# A scanner that eats the machine is its own denial of service.
|
|
MemoryMax=1G
|
|
TasksMax=64
|
|
LimitNOFILE=65536
|
|
OOMScoreAdjust=-500
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|