How can I sandbox radvd?

[crocket]

radvd needs access to open_icmpv6_socket before dropping root privilege.

[rusty-snake]

If you use systemd to start radvd, use it's native features. Since you use openrc IIRC, you need to write a firejail profile for it. IDK what you mean with open_icmpv6_socket (neither a syscall nor a program) but such daemons usually require some capabilities.

[crocket]

I'm just a prepper. That's my threat model. I prepare for security breaches before it's too late.

I'm also against establishment. So, I might get targeted by the establishment in some ways in the future.
I just don't know how targeted I will be.

Perhaps, AppArmor is better for programs running as root and system services?

[rusty-snake]

If your thread model are targeted attacks:

• https://tails.boum.org/
• https://www.whonix.org/
• https://www.qubes-os.org/

Perhaps, AppArmor is better for programs running as root and system services?

Controlling something (or someone) works better the higher you are in the hierarchy. Controlling something on the same level is difficult and controlling something on a higher level is impossible.

radvd: userspace:root
firefox: userspace:user

firejail: userspace:root
apparmor: kernelspace

[crocket]

I'm not specifically targeted as an individual. I'm rather targeted as a minority group for now. Specificity of targeting may change if I end up having to raise my profile in the future. But, I will try to lay low as much as possible.

To be honest, I wouldn't use qubes or whonix because they waste too much resource for my taste. Combining tor bridge with --net=tor and --dns=bridge-ip-address is sufficient for now. I also apply --net=none to media players in order to prevent them from fetching metadata over the internet. I will also make network namespaces and linux bridges for yggdrasil and VPNs.

SELinux, AppArmor, and firejail with web browsers in private mode fit my threat model for now.

Even if I'm specifically targeted, firejail and apparmor raise security and privacy above a certain baseline. It's much better than nothing.

[crocket]

Which one do you recommend between AppArmor and SELinux? It seems to me that SELinux provides system-wide permissions and application-level permissions while AppArmor focuses on application-level path permissions.

I think that by combining firejail with AppArmor or SELinux, I can effectively sandbox system services that start as root and may or may not drop privileges later.

Update // It seems that SELinux focuses on denying most permissions by default and gradually allowing permissions for a few dedicated applications and AppArmor allows everything by default and gradually tightens permissions. AppArmor is easier if I want to sandbox a few applications and SELinux is easier if I want to protect the entire system. However, SELinux requires extended attributes on file systems. AppArmor works on file systems that don't have extended attributes. I don't mind extended attributes as long as they aren't actually written to file systems. I don't want SELinux to actually write extended attributes on disk. My choice is AppArmor.

[crocket]

It turns out that setcap cap_net_raw=ep /usr/sbin/radvd allows me to execute radvd as an unprivileged user.

I already made the gentoo package for radvd execute setcap cap_net_raw=ep /usr/sbin/radvd during installation on my system.

I'm going to propose the change to gentoo repository.

[crocket]

I decided to use firejail with apparmor in order to sandbox applications and system services that run as root and may drop root privilege later.