greywall

Archived

Author	SHA1	Message	Date
Mathieu Virbel	cb474b2d99	feat: add macOS daemon support with group-based pf routing - Add daemon CLI subcommand (install/uninstall/status/run) - Download tun2socks for darwin platforms in Makefile - Export ExtractTun2Socks and add darwin embed support - Use group-based pf filtering instead of user-based for transparent proxying - Install sudoers rule for passwordless sandbox-exec with _greywall group - Add nolint directives for gosec false positives on sudoers 0440 perms - Fix lint issues: lowercase errors, fmt.Fprintf, nolint comments	2026-02-26 09:56:22 -06:00
Mathieu Virbel	5aeb9c86c0	fix: resolve all golangci-lint v2 warnings (29 issues) Some checks failed Build and test / Build (push) Successful in 11s Details Build and test / Lint (push) Failing after 1m15s Details Build and test / Test (Linux) (push) Failing after 42s Details Migrate to golangci-lint v2 config format and fix all lint issues: - errcheck: add explicit error handling for Close/Remove calls - gocritic: convert if-else chains to switch statements - gosec: tighten file permissions, add nolint for intentional cases - staticcheck: lowercase error strings, simplify boolean returns Also update Makefile to install golangci-lint v2 and update CLAUDE.md.	2026-02-13 19:20:40 -06:00
Mathieu Virbel	c19370f8b3	feat: deny-by-default filesystem isolation Some checks failed Build and test / Lint (push) Failing after 1m16s Details Build and test / Build (push) Successful in 13s Details Build and test / Test (Linux) (push) Failing after 41s Details Build and test / Test (macOS) (push) Has been cancelled Details - Deny-by-default filesystem isolation for Linux (Landlock) and macOS (Seatbelt) - Prevent learning mode from collapsing read paths to $HOME - Add Linux deny-by-default lessons to experience docs	2026-02-13 11:39:18 -06:00
Mathieu Virbel	3dd772d35a	feat: add --learning mode, --template flag, and fix DNS relay Some checks failed Build and test / Lint (push) Failing after 1m29s Details Build and test / Build (push) Successful in 13s Details Build and test / Test (Linux) (push) Failing after 58s Details Build and test / Test (macOS) (push) Has been cancelled Details Learning mode (--learning) traces filesystem access with strace and generates minimal sandbox config templates. A background monitor kills strace when the main command exits so long-lived child processes (LSP servers, file watchers) don't cause hangs. Other changes: - Add 'greywall templates list/show' subcommand - Add --template flag to load specific learned templates - Fix DNS relay: use TCP DNS (options use-vc) instead of broken UDP relay through tun2socks - Filter O_DIRECTORY opens from learned read paths - Add docs/experience.md with development notes	2026-02-11 08:22:53 -06:00

4 Commits