veilor-os/docs/research/2026-05-05-agent-wave/04-hardening-tier-2.md

Hardening tier 2 — concrete plan

Agent 4 of 9-agent wave, 2026-05-05.

Repo state already in tree

• scripts/apparmor/ ships 3 profiles (thorium, veilor-power, lm-studio) — complain-mode, not auto-loaded. No browser/mail /Element profile.
• scripts/selinux/ ships custom .te modules — primary MAC.
• overlay/etc/audit/plugins.d/veilor-remote.conf + audisp-remote.conf.disabled — scaffold present, opt-in switch missing.
• kickstart/veilor-os.ks — single live-ks. Real LUKS install lives in overlay/usr/local/bin/veilor-installer (generates ks at runtime).
• No nftables overlay. No homed scaffold. No veilor-audit-shipping CLI.

Item-by-item plan

1. AppArmor stack with SELinux — M

Fedora 43 ships apparmor-parser/libapparmor. Kernel has both LSMs. Stacking works since 5.1; SELinux stays primary, AppArmor confines specific binaries by path. No conflict — they layer. Risk: AA profiles based on Debian/Ubuntu paths fail on Fedora.

Files:

• kickstart/veilor-os.ks %packages add apparmor-parser apparmor-utils apparmor-profiles
• overlay/etc/apparmor.d/veilor.d/ (new) — vendor profiles firefox, thunderbird, element-desktop, signal-desktop
• scripts/40-apparmor.sh (new) — parses + sets all veilor profiles to complain on first install (logs only, no break)
• overlay/usr/local/bin/veilor-doctor — adds AA status check

Test: aa-status | grep complain shows >=4 loaded; firefox writes outside policy → audit.log denial.

2. systemd-homed opt-in — L

Default LUKS storage homectl drops key on suspend; resume needs PAM unlock again — breaks "lid open, keep working". Use --storage=fscrypt on top of existing btrfs /home subvol — suspend transparent, encrypts at rest with per-user key.

Files:

• overlay/usr/local/bin/veilor-homed-enable (new) — confirms warning, runs homectl create admin --storage=fscrypt --real-name="veilor admin" after migrating files
• overlay/etc/pam.d/sddm drop-in for pam_systemd_home.so
• doc in docs/HARDENING.md. Not auto-run — only via post-install.

3. nftables alongside firewalld — S

firewalld speaks nftables backend on F43 — they don't conflict; firewalld owns inet firewalld table. veilor-os preset = separate inet veilor table loaded by its own service.

Files:

• overlay/etc/nftables/veilor.nft (new) — table inet veilor: ssh per-IP rate limit (5/min), ICMP rate limit, optional ip6 daddr ::/0 drop toggled by sysctl-style /etc/veilor/ipv6.disabled, anti-port-scan via meter set
• overlay/etc/systemd/system/veilor-nftables.service (new) — After=firewalld.service
• kickstart/veilor-os.ks %packages add nftables, services-enabled add veilor-nftables

Test: nft list ruleset shows both firewalld AND veilor; hping3 -S -p 22 --flood from second VM gets rate-limited.

4. Audit log shipping — S

Plumbing already in tree (audisp-remote.conf.disabled, veilor-remote.conf with active=no). What's missing: CLI to flip the switch with cert pinning.

Files:

• overlay/usr/local/bin/veilor-audit-shipping (new)
  • enable HOST PORT FINGERPRINT writes /etc/veilor/audit-pin.sha256, copies audisp-remote.conf.disabled → audisp-remote.conf with substituted host/port, enables plugin (active=yes), restarts auditd
  • disable reverses
• audisp-remote speaks TLS directly; cert pinning via verify_peer=yes
  • peer_cert_fingerprint
• Use self-signed pinned, not LE — collectors are LAN/VPN

Test: stand up rsyslog listener on nullstone with self-signed cert; run helper; trigger sudo -i; tail nullstone for AUTHPRIV event; revoke cert → events stop with logged TLS error.

5. Installer kickstart split — needs re-scope, S

Roadmap item is stale. As of v0.5.30 we already do real LUKS+btrfs in veilor-installer which generates ks at runtime. Re-scope: extract that generated ks template into static kickstart/veilor-os-install.ks (parameterised via %include /tmp/answers.ks), so reviewable in repo and reusable headlessly.

Files:

• split overlay/usr/local/bin/veilor-installer heredoc into kickstart/veilor-os-install.ks
• installer just writes answers + cp the ks
• CI lints both with ksvalidator

6. Audit baseline re-run — S

Mechanical: cp security/audit-template.md security/veilor-os-distro/2026-05-DD.md, run on VM, target lower findings count than v0.2's baseline.

Order, dependencies, ship plan

Dependencies: (5) blocks (6) — audit a stable installer, not a moving heredoc. Else parallel.

Total effort: 2S + 1S(rescope) + 1S + 1M + 1L ≈ 5–7 dev-days.

• v0.5.32 (small wins): (4) audit shipping CLI + (3) nftables preset. Both S, scaffold completion, pure overlay (no kickstart risk).
• v0.5.33: (5) ks split + (6) audit baseline re-run.
• v0.6 (medium): (1) AppArmor stack — package install + 4 profiles
  • doctor integration; complain-mode keeps blast radius zero.
• v0.7 (big lift): (2) systemd-homed — UX-disruptive, needs migration helper + doc page + suspend/lock/swap testing.