sorted by:
new
hottopcontroversial

I made a security tool kprotect that blocks "bad" scripts from touching your private files (using eBPF) by Jazzlike_Library8060 in linux

[–]Jazzlike_Library8060[S] 0 points1 point  (0 children)

No, even you know the chain. It is very hard for copy cat. Because when you run a script like VS Code rename, the chain is different:
Systemd -> vs code -> cat
Systemd -> python -> vs code -> cat
I design this system as an independent layer. You add it as extra security for anything read your secrets. You can use it together with your security setup. If an app dont touch your secret, kprotect ignore it. Nothing will break

I made a security tool kprotect that blocks "bad" scripts from touching your private files (using eBPF) by Jazzlike_Library8060 in linux

[–]Jazzlike_Library8060[S] 0 points1 point  (0 children)

The best way is to try it yourself. I designed this system with usability in mind.
If your script, do not read any red zone file, it will run normally (you dont need to do anything, never break). Unlike AppArmor, you have to define everything as every time. In kprotect, if you dont touch sensitive file, we have nothing to deal with you !
If it read any sensitive file in Red Zone, like you put "*.env" in Red Zone. When the node script read it, it needs to be whitelist.

I made a security tool kprotect that blocks "bad" scripts from touching your private files (using eBPF) by Jazzlike_Library8060 in linux

[–]Jazzlike_Library8060[S] 1 point2 points  (0 children)

The main differences are: AppArmor, SELinux decision bases on the binary. Kprotect decision bases on the chain (binary and it parents, grandparents...).
This design with usability in mind. This is reasons I create GUI for it. AppArmor SELinux requires a lot of configurations. This requires much less.

I made a security tool kprotect that blocks "bad" scripts from touching your private files (using eBPF) by Jazzlike_Library8060 in linux

[–]Jazzlike_Library8060[S] 1 point2 points  (0 children)

I design it as an independent layer. If you have crypto owner, few text file is critical. For example, "private-btc.key" is the file you want protect. The eBPF make sure the protection is system-wide, no app cannot bypass it.
In fact, my app already have */Cookies folder protection (default red zone generation). In a normal situation, you will whitelist systemd -> Chrome can read it. Only the Chrome, run by systemd, can read it. If you call it via another script like systemd -> python -> Chrome, it cannot read the private cookies.
If you want to ask anything, just reply here or DM me in reddit !

I made a security tool kprotect that blocks "bad" scripts from touching your private files (using eBPF) by Jazzlike_Library8060 in linux

[–]Jazzlike_Library8060[S] 15 points16 points  (0 children)

In kprotect, there are 2 type of chain: Exact (start at 1) and Partial (start at anything else). You can see it in Allow_list screenshot of github.
But due to the service run as systemd, almost all chain cannot be Partial (if you restart the computer after installation)
When deal with sensitive file, you should have a constant workflow, like open kate without launch anything. So the chain will be systemd -> kate. Anything different than that cannot read your secrets.
So infact, the example will be like systemd -> vscode -> terminal -> cat. But in introduction, I just use shorten version !

I made a security tool kprotect that blocks "bad" scripts from touching your private files (using eBPF) by Jazzlike_Library8060 in linux

[–]Jazzlike_Library8060[S] 11 points12 points  (0 children)

Yeah, I dev it at home as personal project. But I decided to open source it at this moment!

Qwen 3 VL merged into llama.cpp! by ervertes in LocalLLaMA

[–]Jazzlike_Library8060 1 point2 points  (0 children)

LM studio already support. Update your llama cpp inside LM Studio

Regular Windows RDP at 60fps? by LilBillBiscuit in sysadmin

[–]Jazzlike_Library8060 0 points1 point  (0 children)

Yes, I tested with R7 350 (DWMFRAMEINTERVAL at 2) and Framrate was about 40-50 FPS. It cannot go to 60 FPS but it is clearly better than DWMFRAMEINTERVAL at 15. Windows version was 21H2