# Syd profile for Nginx
# Copyright (c) 2023, 2024, 2025 Ali Polatel <alip@hexsys.org>
# Distributed under the terms of the GNU General Public License v2

# Enable SafeSetID to drop user/group.
setuid+root:nginx
setgid+root:nginx

# Allow TTY interaction.
include_profile tty

# Landlock
sandbox/lock:on

# Allow listen to HTTP and HTTPS.
trace/allow_unsafe_bind:true
allow/lock/bind+80
allow/lock/bind+443

allow/net/bind+any!80
allow/net/bind+any!443

# Allow access to /dev/null
allow/lock/read,write+/dev/null
allow/lpath,rpath,wpath+/dev/null
allow/lpath+/dev

# Allow access to configuration
allow/lpath,rpath+/
allow/lpath,rpath+/etc
allow/lpath,rpath+/etc/env.d/***
allow/lpath,rpath+/etc/nginx/***
allow/lock/rpath+/etc/env.d
allow/lock/rpath+/etc/nginx

# Allow access to the web root
allow/lock/rpath+/srv/www/nginx
allow/lpath,rpath+/srv/www/nginx/***
allow/lpath+/srv
allow/lpath+/srv/www

# Allow access to SSL certificates
allow/lock/rpath+/etc/ssl
allow/lpath,rpath+/etc/ssl/***
allow/lock/rpath+/etc/letsencrypt
allow/lpath,rpath+/etc/letsencrypt/***

# Allow logging, pidfile and private tmp.
allow/net/connect+/dev/log
allow/net/sendfd+!unnamed

allow/lpath+/var
allow/lpath+/var/log
allow/lpath+/tmp
allow/lock/rpath,wpath,cpath+/run/nginx
allow/lock/rpath,wpath,cpath+/var/log/nginx
allow/lock/rpath,wpath,cpath,tpath+/tmp/nginx
allow/lpath,rpath,wpath,cpath+/run/nginx/***
allow/lpath,rpath,wpath,cpath+/var/log/nginx/***
allow/lpath,rpath,wpath,cpath,tpath+/tmp/nginx/***

# Allow access to system paths.
allow/lpath,rpath+/dev/urandom
allow/lock/read+/dev/urandom

allow/lpath,rpath+/etc/hosts
allow/lock/read+/etc/hosts

allow/lpath,rpath+/etc/group
allow/lock/read+/etc/group

allow/lpath,rpath+/etc/passwd
allow/lock/read+/etc/passwd

allow/lpath,rpath+/etc/resolv.conf
allow/lock/read+/etc/resolv.conf

allow/lpath,rpath+/etc/nsswitch.conf
allow/lock/read+/etc/nsswitch.conf

allow/lpath,rpath+/etc/services
allow/lock/read+/etc/services

allow/lpath,rpath+/usr/share/zoneinfo-posix/Etc/UTC
allow/lock/read+/usr/share/zoneinfo-posix/Etc/UTC
allow/lpath+/etc/localtime

# Allow executing the nginx binary.
allow/lock/rpath+/proc
allow/lock/wpath+/run
allow/lock/wpath+/var/run
allow/lock/rpath,exec+/usr
allow/lock/read+/etc/ld-x86_64-pc-linux-gnu.cache
allow/lpath,rpath+/etc/ld-*.cache
allow/lpath,rpath,exec+/bin/***
allow/lpath,rpath,exec+/usr/***
allow/lpath,rpath,exec+/lib*/***
allow/lpath,rpath+/run/***
allow/lpath,rpath+/var/run/***

# Reduce noise.
filter/net/connect+/run/systemd/userdb/io.systemd.DynamicUser

# Allow limited access to procfs
allow/lpath,rpath+/proc/self/fd
allow/lpath,rpath+/proc/self/fdinfo
allow/lpath,rpath+/proc/self/fdinfo/[0-9]*
allow/lpath,rpath,wpath,ioctl+/proc/self/fd/[0-9]*
allow/lpath,rpath,wpath,ioctl+/proc/self/fd/anon_inode:\[pidfd\]
allow/lpath,rpath,wpath,ioctl+/proc/self/fd/pipe:\[[0-9]*\]
allow/lpath,rpath,wpath,ioctl+/proc/self/fd/socket:\[[0-9]*\]

# Enable IP blocklists
# Source: https://github.com/firehol/blocklist-ipsets.git
include /usr/src/blocklist-ipsets/feodo.ipset
include /usr/src/blocklist-ipsets/feodo_badips.ipset
include /usr/src/blocklist-ipsets/dshield.netset
include /usr/src/blocklist-ipsets/dshield_1d.netset
include /usr/src/blocklist-ipsets/dshield_30d.netset
include /usr/src/blocklist-ipsets/dshield_7d.netset
include /usr/src/blocklist-ipsets/dshield_top_1000.ipset
include /usr/src/blocklist-ipsets/spamhaus_drop.netset
include /usr/src/blocklist-ipsets/spamhaus_edrop.netset

# Simplify block ruleset.
block!

# Enable binary verification.
sandbox/force:on

# Allow nginx binary and libraries.
force+/usr/x86_64-pc-linux-gnu/bin/nginx:145fea7449c604dd6f65b7e7aaf5c7019e0bf63dd0e6a6a15a7b4f3f8b8e904e873a58827e3c354e80219b16ba4c4c3c5e4da6857726b9c71dbcf8e8da39d8d6
force+/usr/x86_64-pc-linux-gnu/lib/libcrypt.so.2.0.0:d759327c5ca61aa8414b278f50a97acab267f7efce5e1d19d09df79f87bdfa3c8bcd173771118db905f6082e2b8526bc97033a8a6ae835828e566c0affbb2938
force+/usr/x86_64-pc-linux-gnu/lib/libpcre2-8.so.0.13.0:6c5939e5c31d594e79957ffed76822531e551a50be22a52f11e90a30440adf1294ece966088fcc402c983517458ab71d5e65f0a17beec96b0a2e8b91fe84e11f
force+/usr/x86_64-pc-linux-gnu/lib/openssl-3/lib/libssl.so.3:cce039e364020aac9043d79210535be6c4bc2c7d7e4f1917f9850a23051bc16cb975d32d6c333dd3ed0fd10e019b0b20a8bbcfed76ecaa4b950ae686bc21c3dd
force+/usr/x86_64-pc-linux-gnu/lib/openssl-3/lib/libcrypto.so.3:ec3bdabbd59c9f31f8f9da9e8e4e27b3b420726f43c2685a6b4afaa3336738dc2cf03572aa27f382e53962c53facb7a1a354ec2658da9bfab7c06c088093f45a
force+/usr/x86_64-pc-linux-gnu/lib/libz.so.1.3.1:1afdf6d5ef8cd1e657e81fac519e60f30239cf87d5355033d5d4bcf1987cee165c5a1a010c83ea675a5404453c55f7ac597e2e8f8d1981700f626839557b1b0e
force+/usr/x86_64-pc-linux-gnu/lib/libc.so.6:e71c71f1a615e682b500842a3a17c379301193fb87d71ef1b0d2453a02bea9c527bdd0915057426ca7722f45fbc8e4b3dd7b79f272d96820d69f9bf52258e51d
force+/usr/x86_64-pc-linux-gnu/lib/libnss_systemd.so.2:d8eedb8b3f4febe498f4b8207ac8c59c08a7f55ff1b93fe15495202a301e8b604902803a1cf006d06c97ad8db7e74bb5a5699a37416b9790970a4a1f25f454c0
force+/usr/x86_64-pc-linux-gnu/lib/libm.so.6:01b3cf70ee5754b037f09efe01b2c3d350b4163296be23e18b49c47f104e9f38c24671cabef74a6c7d8420c69e35d83711b0f1462860e6db4c20d5b417715c82
force+/usr/x86_64-pc-linux-gnu/lib/libcap.so.2.71:0aad114457dca88b2cc9689af1b91acedfe3bb09cfc678a98128a5ccc8d4b44c43d74f4125cfc79ddfc931b72e5824b5c55e33ef09a00101e72ef031a23665df
force+/usr/x86_64-pc-linux-gnu/lib/libperl.so.5.40.0:39f806d387fe6124e444c4e2b701762b2db5e607f164b75d004323400d0c2c945d72410077562626727f74ff7f5b51325a880d0762a6ff29d47e9aefb32d9812
force+/usr/x86_64-pc-linux-gnu/lib/perl5/site_perl/5.40-arch/auto/nginx/nginx.so:3e99409c588a182d614751429821877d18d5dfaef6076620ae9482053fd3f3e59127e4910f88daad9f3511f71337d942b0dd9c6c39bf4cb0311cc4de43f5aec1
force+/usr/x86_64-pc-linux-gnu/lib/perl5/core_perl/5.40-arch/auto/Fcntl/Fcntl.so:8a90ce199ad519894405100c34fe05c699609d7fc378494edda3b36001949496679c7e77d7c9090e30a9f1e8083e959921e986eda420c7843e8e3e3b5593c1c5
force+/usr/x86_64-pc-linux-gnu/lib/perl5/core_perl/5.40-arch/auto/POSIX/POSIX.so:afaf8314685874f4684054e44a882c5800b65c027db235028bba4ddfda1e3665e4a71236e10b7d36ab6151815d19c4b85b8682a78c7762a69d5f0edb36e7be47
force+/usr/x86_64-pc-linux-gnu/lib/libncurses.so.6.5:6e9d0d5c671c7c49e15ea9ab45737d619fdde0ffda521384962783c632883b28674388286cbf019c3ded26171daa6929964165a0388bfd4511a57ebce59bebde

# Lock the sandbox.
lock:on
