Security hardening and installation examples

[nobody43]

I've managed to run the binary with only CAP_NET_ADMIN, elevated with systemd, so no setcap were necessary. cap_net_bind_service is only needed with lower port? And cap_net_raw? Neither showed on my debugging log.

Integrate in base readme as you see fit.

[garstas]

Hi! Thanks for the work 🚀 Will look into it soon

Is this some kind of wrapper for running this using systemd? Could you clarify what are the benefits of using it this way and is this the propper way of implementing this? I'm not that deep into how systemd works, so clarification is much appreciated, thanks!

[nobody43]

systemd units are the proper way to start an unattended program (service/daemon). It handles prerequisites (like network availability) and manages restrictions (Protect*, Restrict*, etc). Also it provide a way to elevate a capability under specific user/group without touching the file system, which is way more transparent and therefore more predictable.

AppArmor is a separate security mechanism. There are no perfect programs, all of them could contain vulnerabilities. Network programs are even more dangerous. AppArmor provides a way to specify access only to needed resources (mostly file access), everything else is denied. This way even if (when) program is exploited with vulnerability, the attacker will only gain access to what was specified in AppArmor profile.

Also, please consider removing the example of running the program under root. Not only its not necessary - setcap (or systemd unit) already handles necessary access with capabilities. But mainly, it's incredibly dangerous for the end user, and should only be used as a last resort.

[garstas]

Also, please consider removing the example of running the program under root

Yeah, the sudo go part is for developers running it via go compiler. But yes, the documentation does not clearly states that after setting net caps you can run it with no sudo required on Linux (the one for goxray/desktop does), will update it.

Thanks for the response, I will check this when I have more free time 👍