Zoup

5 ms·

1.
by Zoup 1y ago
Fair, KPI for software engineering is shit distilled.
2.
Built a tool to find deep work that normal PR reviews miss(veritum.ai)
2 points by Zoup 1y ago|3 comments
3.
by Zoup 1y ago
I've been working on a small tool that analyzes GitHub pull requests - not to measure speed or volume, but to find deep, high-quality contributions that often get missed in day-to-day reviews. It’s especially useful at the skip-level,
4.
by Zoup 1y ago
V0.1.11 out, with env support and bunch of other fixes, update!
5.
by Zoup 1y ago
Thanks!
6.
by Zoup 1y ago
they can be jailed by landlock, we don't have support in go-landlock tho afaik, @Gnoack
7.
by Zoup 1y ago
well yeah maybe, if you like.
8.
by Zoup 1y ago
ROX isn't self-contradictory, Allowing read() and execve(), but denying write() and truncate() are totally valid and common in secure execution contexts, although things gets worse with directory traverse. So yeah, --rox is fine semant
9.
by Zoup 1y ago
good catch, fixed.
10.
by Zoup 1y ago
give it a try with v0.10: landrun --rox /usr/ --ro /usr/lib ls /usr/bin/
11.
by Zoup 1y ago
Thank you all for your support, I really didn't expect this to take off like this! given that project is roughly two days old (:D) it's still fair to expect some issues all around, please report them on GH if you found one.
12.
by Zoup 1y ago
it's recursive by default
13.
by Zoup 1y ago
yeah it wasn't the best call, have a look at v0.1.4, I think it's better now!
14.
by Zoup 1y ago
in this case doesn't have access to "a" wherever it is... $ landrun --ro /usr cat /usr/bin/ls | wc -l 400 executing ls (as in actual binary execution) will require --exec $ landrun --ro /usr ls /
15.
by Zoup 1y ago
running cat isn't a --exec for one :)
16.
by Zoup 1y ago
V0.1.3 is out now!
17.
by Zoup 1y ago
haha, why!
18.
by Zoup 1y ago
Great job on the lib, thank you!
19.
by Zoup 1y ago
well yeah you'll need --exec when you want to run binaries (unlike... cat?) I hope landlock adds support to bind --exec to actual directories, that'll be fun!
20.
by Zoup 1y ago
yeah you are missing --exec there, which feels a bit useless that you have to mention it, but I prefer things explicit and use all LSM can provide, I can imagine cases where --exec isn't really required. like `cat`. either case have a
21.
by Zoup 1y ago
Yeah I agree with that, just release a new version that does that.
22.
Landrun: Sandbox any Linux process using Landlock, no root or containers(github.com)
518 points by Zoup 1y ago|169 comments
23.
by Zoup 1y ago
Linux Landlock is a kernel-native security module that lets unprivileged processes sandbox themselves - but nobody uses it because the API is ... hard! I built `landrun`, a small CLI tool in Go, to make it practical to sandbox any command w