Repository navigation

Stage 2: web, runtime and database modules - #21

Draft

VectoDE wants to merge 94 commits into

feat/lss-1bfrom

feat/lss-2

Draft

Stage 2: web, runtime and database modules#21
VectoDE wants to merge 94 commits into
feat/lss-1bfrom
feat/lss-2

Commits on Oct 13, 2026
- Stage 2 foundation: service sandbox, web layer, docker-mode requirement
  
  VectoDE
  and
  claude
  committed
  301077c
- Add the nginx, apache and caddy modules and certificate helpers
  
  VectoDE
  and
  claude
  committed
  146252b
- Close three gaps in the Caddy configuration
  
  VectoDE
  and
  claude
  committed
  7eef6a1
- Add the tls and vhost modules
  
  VectoDE
  and
  claude
  committed
  fc7dfb1
- Add the haproxy module for balanced TCP services
  
  VectoDE
  and
  claude
  committed
  093b761
- Test the web layer and hook the web servers into fail2ban and CrowdSec
  
  VectoDE
  and
  claude
  committed
  138511a
- Test the web modules with Pebble on every system
  
  VectoDE
  and
  claude
  committed
  88e5908
- Document the web modules
  
  VectoDE
  and
  claude
  committed
  5037374
- Add the php and composer runtime modules
  
  VectoDE
  and
  claude
  committed
  f7df34c
- Add the node runtime module
  
  VectoDE
  and
  claude
  committed
  89e88b0
- Add the python and ruby runtime modules
  
  VectoDE
  and
  claude
  committed
  7fd1218
- php: read php-fpm -i before matching it
  
  VectoDE
  and
  claude
  committed
  fc9e9b6
- Add the java runtime module
  
  VectoDE
  and
  claude
  committed
  7c88bed
- Add the go runtime module
  
  VectoDE
  and
  claude
  committed
  7305cf0
- Add the dotnet runtime module
  
  VectoDE
  and
  claude
  committed
  b2265ac
- Runtime modules: name the system by ID and version in messages
  
  VectoDE
  and
  claude
  committed
  4e8cce1
- Document the runtime modules and test them on every system
  
  VectoDE
  and
  claude
  committed
  c678852
- Merge branch 'feat/lss-1b' into feat/lss-2
  VectoDE
  committed
  9cc123e
- Add the phpmyadmin, adminer and pgadmin modules
  
  VectoDE
  and
  claude
  committed
  0bcc8da
- Document the database tools; WebSockets through Apache's admin proxy
  
  VectoDE
  and
  claude
  committed
  fb85019
- Add the mariadb module
  
  VectoDE
  and
  claude
  committed
  40e7193
- Add the mysql module
  
  VectoDE
  and
  claude
  committed
  7bc4046
- mysql: never let root exist without a password
  
  VectoDE
  and
  claude
  committed
  a5cabd3
- mysql, mariadb: delete only fixed paths, and nothing on a failed start
  
  VectoDE
  and
  claude
  committed
  e6a2264
- Add the postgresql module
  
  VectoDE
  and
  claude
  committed
  b9a8e86
- postgresql: isolate application roles, keep root out of postgres-owned paths
  
  VectoDE
  and
  claude
  committed
  e3a2302
- mysql: keep the bootstrap file out of a directory mysql owns
  
  VectoDE
  and
  claude
  committed
  1c7f07f
- Add the redis module
  
  VectoDE
  and
  claude
  committed
  038f0a0
- Add the valkey module
  
  VectoDE
  and
  claude
  committed
  ba501e9
- Add the mongodb module
  
  VectoDE
  and
  claude
  committed
  7896e7d
- redis, valkey: label a non-default port for SELinux
  
  VectoDE
  and
  claude
  committed
  d6c851b
- Integration settings for the database modules
  
  VectoDE
  and
  claude
  committed
  03047b2
- mongodb: authorization on from the first start
  
  VectoDE
  and
  claude
  committed
  11e07fe
- Run the last command of a pipeline in the current shell
  
  VectoDE
  and
  claude
  committed
  f4c6d09
- Add the modsecurity module: a web application firewall for nginx and Apache
  
  VectoDE
  and
  claude
  committed
  8f52b2d
- Profiles webhosting and all; test databases and modsecurity on every system
  
  VectoDE
  and
  claude
  committed
  949ef7d
- Fix the first CI findings of the web modules
  
  VectoDE
  and
  claude
  committed
  6ccfc7a
- fix(security): stable unit paths on RHEL, quiet augenrules and firewalld start
  
  VectoDE
  and
  claude
  committed
  73bb165
- ci(dco): skip merge commits like the DCO GitHub App
  
  VectoDE
  and
  claude
  committed
  45247ce
- fix(service): let scanners enter their SELinux domain
  
  VectoDE
  and
  claude
  committed
  d185701
- style(postgresql): explain the single-quoted inner script for ShellCheck
  
  VectoDE
  and
  claude
  committed
  6fc0a06
- fix(repo): separate RPM key for NodeSource
  
  VectoDE
  and
  claude
  committed
  d61b924
- fix(vhost): delete the certificate of a removed site
  
  VectoDE
  and
  claude
  committed
  6fdb59d
- fix(database): data directory before the sandbox, wait for reloads
  
  VectoDE
  and
  claude
  committed
  6ac87f2
- test(integration): Pebble for profiles with tls, robust diagnostics
  
  VectoDE
  and
  claude
  committed
  ed41adf
- test(web): cover sites, admin paths, certificates and reload for all web servers
  
  VectoDE
  and
  claude
  committed
  9882fa0
- fix(caddy): access log owned by caddy before the configuration test
  
  VectoDE
  and
  claude
  committed
  972c0f6
- style(mongodb): shfmt layout of the here-document substitutions
  
  VectoDE
  and
  claude
  committed
  8605388
- fix(test): match tls in the profile's module list
  
  VectoDE
  and
  claude
  committed
  e543dc8
- ci(integration): Lynis minimum 80 for the RHEL family
  
  VectoDE
  and
  claude
  committed
  1c6700d
Commits on Oct 14, 2026
- fix(mysql): cap the open file limit for the package scripts
  
  VectoDE
  and
  claude
  committed
  d52e583
- fix(web): build libmodsecurity and the nginx connector on every distribution
  
  VectoDE
  and
  claude
  committed
  f429076
- fix(base): install locales so a second run leaves /etc/default/locale alone
  
  VectoDE
  and
  claude
  committed
  7dacaf3
- refactor: resolve SonarQube findings in valkey and the test stubs
  
  VectoDE
  and
  claude
  committed
  126b576
- fix(database): sandbox the data directory MariaDB is configured for
  
  VectoDE
  and
  claude
  committed
  d6f2185
- fix(pkg): retry dnf transactions when a mirror drops out
  
  VectoDE
  and
  claude
  committed
  6cafbbd
- fix(pkg): keep apt notices that report nothing to do out of the log
  
  VectoDE
  and
  claude
  committed
  8e5c5d8
- Merge feat/lss-1b into feat/lss-2
  
  VectoDE
  and
  claude
  committed
  6e38985
- fix(web): pick the libxml2 runtime package apt offers
  
  VectoDE
  and
  claude
  committed
  590c9bc
- fix(database): ask the MariaDB server for its data directory
  
  VectoDE
  and
  claude
  committed
  b266323
- fix(web): build the nginx connector with PCRE1 for nginx before 1.21.5
  
  VectoDE
  and
  claude
  committed
  462482b
- fix(web): write the fail2ban jails while the web server is being installed
  
  VectoDE
  and
  claude
  committed
  479d427
- test: end hanging lss runs after 40 minutes and keep kcov's trace out of the log
  
  VectoDE
  and
  claude
  committed
  b78a6e0
- fix(base): flush the swap file before swapon
  
  VectoDE
  and
  claude
  committed
  61d0f48
- fix(service): stop waiting for a unit after five minutes
  
  VectoDE
  and
  claude
  committed
  2a49aab
- fix(database): let MySQL write its error log and socket directory
  
  VectoDE
  and
  claude
  committed
  3a60905
- feat(web): build mod_security2 for Apache on Ubuntu 22.04 and use CRS 4 everywhere
  
  VectoDE
  and
  claude
  committed
  dbd9b46
- fix(web): use the pinned CRS version; show MySQL and AppArmor diagnostics
  
  VectoDE
  and
  claude
  committed
  614d622
- fix(mysql): keep mysqld's start notification working under AppArmor
  
  VectoDE
  and
  claude
  committed
  ae9e99d
- fix(service): decide AppArmor confinement fail-closed
  
  VectoDE
  and
  claude
  committed
  d6fcf29
- test(integration): list the Lynis tests that cost hardening points
  
  VectoDE
  and
  claude
  committed
  d57e012
- fix(swap, modsecurity): flush the swap file last; pkg-config for mod_security2
  
  VectoDE
  and
  claude
  committed
  72d1f18
- fix(modsecurity): let the nginx workers append to the audit log
  
  VectoDE
  and
  claude
  committed
  824d699
- test(integration): read Lynis' partial hardening points correctly
  
  VectoDE
  and
  claude
  committed
  e1ea116
Commits on Oct 15, 2026
- fix(modsecurity): debug the missing nginx audit entry instead of guessing
  
  VectoDE
  and
  claude
  committed
  54a3bef
- test(integration): install pending updates in the profile runs
  
  VectoDE
  and
  claude
  committed
  e33ad07
- fix(modsecurity): build the nginx module against the distribution's patched sources
  
  VectoDE
  and
  claude
  committed
  56bbf26
- chore(modsecurity): drop the nginx debug probe
  
  VectoDE
  and
  claude
  committed
  01c573e
- docs(readme): resource figures of the web, runtime and database modules
  
  VectoDE
  and
  claude
  committed
  941dcce
- ci(integration): profile all on every VM distribution at night
  
  VectoDE
  and
  claude
  committed
  3fbefaf
- ci(integration): nightly profile all on Ubuntu VMs too
  
  VectoDE
  and
  claude
  committed
  e454618
- fix(web): label the admin port for web servers under SELinux
  
  VectoDE
  and
  claude
  committed
  3bdc1f1
- test(integration): show AppArmor and SELinux denials from the audit log
  
  VectoDE
  and
  claude
  committed
  c2c8642
- fix(database): show the web server's error log when an admin page fails
  
  VectoDE
  and
  claude
  committed
  d5f3402
- fix(php): extend PHP-FPM's AppArmor profile on Ubuntu 24.04 and later
  
  VectoDE
  and
  claude
  committed
  620979b
- fix(haproxy): let haproxy enter its SELinux domain
  
  VectoDE
  and
  claude
  committed
  d17a1e5
- fix(admin-user): keep the run lock away from passwd and chpasswd
  
  VectoDE
  and
  claude
  committed
  4dce9f8
- fix(service): let sandboxed services enter their SELinux domain
  
  VectoDE
  and
  claude
  committed
  5bf98cc
- fix(modsecurity): read YAJL support from the engine file itself
  
  VectoDE
  and
  claude
  committed
  3246f69
- fix(php): allow the lss pool socket in PHP-FPM's AppArmor profile
  
  VectoDE
  and
  claude
  committed
  0e529bd
- fix(service): keep NoNewPrivileges for programs without an SELinux domain
  
  VectoDE
  and
  claude
  committed
  30f8947
- fix(service): allow SELinux domain transitions under NoNewPrivileges with a policy module
  
  VectoDE
  and
  claude
  committed
  b6276da
- fix: SELinux policy module once the program exists; yescrypt cost only with yescrypt
  
  VectoDE
  and
  claude
  committed
  b7a601a
- style: quote test values for the newer shellcheck, name the key in _pp_login_defs_drop
  
  VectoDE
  and
  claude
  committed
  c18a1a1

Commits

Commits on Oct 13, 2026

Commits on Oct 14, 2026

Commits on Oct 15, 2026