sandboxing.md (3517B)
1 # Application sandboxing 2 3 By sandboxing the GoToSocial binary it's possible to control which parts of the system GoToSocial can access, and limit which things it can read and write. This can be helpful to ensure that even in the face of a security issue in GoToSocial, an attacker is severely hindered in escalating their privileges and gaining a foothold on your system. 4 5 !!! note 6 As GoToSocial is still early in its development, the sandboxing policies we ship may get out of date. If you happen to run into this, please raise an issue on the issue tracker or better yet submit a PR to help us fix it. 7 8 Different distributions have different sandboxing mechanisms they prefer and support: 9 10 * **AppArmor** for the Debian or Ubuntu family of distributions or OpenSuSE, including when running with Docker 11 * **SELinux** for the Red Hat/Fedora/CentOS family of distributions or Gentoo 12 13 !!! warning "Containers and sandboxing" 14 Running GoToSocial as a container does not in and of itself provide much additional security. Despite their name, "containers do not contain". Containers are a distribution mechanism, not a security sandbox. To further secure your container you can instruct the container runtime to load the AppArmor profile and look into limiting which syscalls can be used using a seccomp profile. 15 16 ## AppArmor 17 18 We ship an example AppArmor policy for GoToSocial, which you can retrieve and install as follows: 19 20 ```sh 21 $ curl -LO 'https://github.com/superseriousbusiness/gotosocial/raw/main/example/apparmor/gotosocial' 22 $ sudo install -o root -g root gotosocial /etc/apparmor.d/gotosocial 23 $ sudo apparmor_parser -Kr /etc/apparmor.d/gotosocial 24 ``` 25 26 !!! tip 27 If you're using SQLite, the AppArmor profile expects the database in `/gotosocial/db/` so you'll need to adjust your configuration paths or the policy accordingly. 28 29 With the policy installed, you'll need to configure your system to use it to constrain the permissions GoToSocial has. 30 31 You can disable the policy like this: 32 33 ```sh 34 $ sudo apparmor_parser -R /etc/apparmor.d/gotosocial 35 $ sudo rm -vi /etc/apparmor.d/gotosocial 36 ``` 37 Don't forget to roll back any configuration changes you made that load the AppArmor policy. 38 39 ### systemd 40 41 Add the following to the systemd service, or create an override: 42 43 ```ini 44 [Service] 45 ... 46 AppArmorProfile=gotosocial 47 ``` 48 49 Reload systemd and restart GoToSocial: 50 51 ``` 52 $ systemctl daemon-reload 53 $ systemctl restart gotosocial 54 ``` 55 56 ### Containers 57 58 !!! tip 59 You should review the [Docker](https://docs.docker.com/engine/security/apparmor/) or [Podman](https://docs.podman.io/en/latest/markdown/options/security-opt.html) documentation on AppArmor. 60 61 When using our example Compose file, you can tell it to load the AppArmor policy by tweaking it like so: 62 63 ```yaml 64 services: 65 gotosocial: 66 ... 67 security_opt: 68 - apparmor=gotosocial 69 ``` 70 71 When launching the container with `docker run` or `podman run`, you'll need the `--security-opt="apparmor=gotosocial"` command line flag. 72 73 ## SELinux 74 75 !!! note 76 SELinux can only be used in combination with the [binary installation](../../getting_started/installation/metal.md) method. SELinux cannot be used to constrain GoToSocial when running in a container. 77 78 The SELinux policy is maintained by the community in the [`lzap/gotosocial-selinux`](https://github.com/lzap/gotosocial-selinux) repository on GitHub. Make sure to read its documentation, review the policy before using it and use their issue tracker for any support requests around the SELinux policy.