# /etc/user.syd-3 for syd.chesswob.org
#
# 1. These rules are applied on top of the static user profile rules:
#    Search PROFILE_USER in this file: https://gitlab.exherbo.org/sydbox/sydbox/-/blob/main/src/config.rs
#    or do "syd-cat -puser" if you have Syd installed.
# 2. Add the following environment variables to /etc/environment or equivalent:
#    SYD_LOG_FD=-1
#    SYD_SHELL=/bin/bash

# Silence all access violations.
# See: "syd-cat -pquiet" for the rules,
# or search PROFILE_QUIET in the link above.
include_profile quiet

# Timeout is 15 minutes.
timeout:15m

# Allow execution of non-PIE executables.
trace/allow_unsafe_exec_nopie:1

# Immutable profile mounts a tmpfs on:
# /dev/shm, /run and /var/run.
# Relax Landlock restrictions.
allow/lock/all+/dev/shm
allow/lock/all+/run
allow/lock/all+/var/run

# Add third layer using immutable container.
include_profile immutable

# Immutable profile mounts /home read-only.
# Revert this behaviour.
bind-/home:/home
bind+/home:/home:rw,nodev,nosuid,nosymfollow

# Enable Memory/Pid sandbox.
# Useful against fork bombs.
mem/max:2G
pid/max:128

# Network access only available via TOR.
sandbox/proxy:on
#proxy/ext/unix:/run/tor/socks
deny/net/bind+/***
deny/net/connect+/***
deny/net/bind+any!0-65535
deny/net/connect+any!0-65535
allow/net/connect+loopback!9050
allow/lock/connect+9050

# Allow torsocks.so to be LD_PRELOAD'ed,
# for convenience to users so they do not
# have to manually configure SOCKS5 proxy.
trace/allow_unsafe_exec_libc:1
allow/lpath,rpath+/etc/tor
allow/lpath,rpath+/etc/tor/torsocks.conf

#
# Relax USER profile!
#
# 1. Allow reading dotfiles!
allow/lpath,rpath+${HOME}/**/.*/***
# 2. Allow creating executable files!
trace/force_umask:7077
# 3. Allow magic links.
trace/force_no_magiclinks:false
##
##

# Let's guide the user:
deny/read+/etc/CTF
deny/read+/home/*/README
allow/lpath+/etc/CTF
allow/lpath+/home/*/README
allow/lpath,rpath+/etc/user.syd-3

# Set sandbox lock to Drop for drop-only mode.
lock:drop
