feat: multiple securecore improvements

files/system/usr/share/ublue-os/just/60-custom.just

@@ -509,52 +509,53 @@ audit-secureblue:
         print_status "$ENVIRONMENT_TEST_STRING" "$STATUS_WARNING"
     fi
 
-    remotes="$(flatpak remotes -d)"
+    if command -v flatpak &> /dev/null
-    while read -r remote ; do
+        remotes="$(flatpak remotes -d)"
-        ref="$(cut -f 1 <<<"$remote")"
+        while read -r remote ; do
-        url="$(cut -f 3 <<< "$remote")"
+            ref="$(cut -f 1 <<<"$remote")"
-        subset="$(cut -f 5 <<< "$remote")"
+            url="$(cut -f 3 <<< "$remote")"
-        remote_string="Auditing flatpak remote $ref"
+            subset="$(cut -f 5 <<< "$remote")"
-        if [[ "$url" != "https://dl.flathub.org/repo/" && "$url" != "https://dl.flathub.org/beta-repo/" ]]; then
+            remote_string="Auditing flatpak remote $ref"
-            print_status "$remote_string" "$STATUS_FAILURE"
+            if [[ "$url" != "https://dl.flathub.org/repo/" && "$url" != "https://dl.flathub.org/beta-repo/" ]]; then
-            echo "> $ref is configured with an unknown url!"
+                print_status "$remote_string" "$STATUS_FAILURE"
-        elif [ "$subset" != "verified" ]; then
+                echo "> $ref is configured with an unknown url!"
-            print_status "$remote_string" "$STATUS_FAILURE"
+            elif [ "$subset" != "verified" ]; then
-            echo "> $ref is not a verified repo!"
+                print_status "$remote_string" "$STATUS_FAILURE"
-        else
+                echo "> $ref is not a verified repo!"
-            print_status "$remote_string" "$STATUS_SUCCESS"
+            else
-        fi
+                print_status "$remote_string" "$STATUS_SUCCESS"
-    done <<< "$remotes"
+            fi
+        done <<< "$remotes"
         
-    declare -A flatpaks
+        declare -A flatpaks
-    while read -r ref version; do
+        while read -r ref version; do
-        flatpaks+=(["${ref}"]="${ref}//${version}")
+            flatpaks+=(["${ref}"]="${ref}//${version}")
-    done <<<$(flatpak list | sort -k 1 | cut --fields 2,4)
+        done <<<$(flatpak list | sort -k 1 | cut --fields 2,4)
-    for f in ${!flatpaks[@]}; do
+        for f in ${!flatpaks[@]}; do
-        has_network=false
+            has_network=false
-        has_x11=false
+            has_x11=false
-        fullref=${flatpaks["$f"]}
+            fullref=${flatpaks["$f"]}
-        permissions=$(flatpak info --show-permissions "$fullref")
+            permissions=$(flatpak info --show-permissions "$fullref")
-        if hasPermission "$permissions" "shared" "network"; then
+            if hasPermission "$permissions" "shared" "network"; then
-            has_network=true
+                has_network=true
-        fi
+            fi
-        if hasPermission "$permissions" "sockets" "x11" && ! hasPermission "$permissions" "sockets" "fallback-x11"  ]]; then
+            if hasPermission "$permissions" "sockets" "x11" && ! hasPermission "$permissions" "sockets" "fallback-x11"  ]]; then
-            has_x11=true
+                has_x11=true
-        fi
+            fi
-        flatpak_test_string="Auditing $f"
+            flatpak_test_string="Auditing $f"
-        if [[ ! $has_network == "true" && ! $has_x11 == "true" ]]; then
+            if [[ ! $has_network == "true" && ! $has_x11 == "true" ]]; then
-            print_status "$flatpak_test_string" "$STATUS_SUCCESS"
+                print_status "$flatpak_test_string" "$STATUS_SUCCESS"
-        elif [[ $has_x11 == "true" ]]; then
+            elif [[ $has_x11 == "true" ]]; then
-            print_status "$flatpak_test_string" "$STATUS_FAILURE"
+                print_status "$flatpak_test_string" "$STATUS_FAILURE"
-        elif [[ $has_network == "true" ]]; then
+            elif [[ $has_network == "true" ]]; then
-            print_status "$flatpak_test_string" "$STATUS_WARNING"
+                print_status "$flatpak_test_string" "$STATUS_WARNING"
-        fi
+            fi
-        if [[ $has_network == "true" ]]; then
+            if [[ $has_network == "true" ]]; then
-            echo "> $f has network access!"
+                echo "> $f has network access!"
-        fi
+            fi
-        if [[ $has_x11 == "true" ]]; then
+            if [[ $has_x11 == "true" ]]; then
-            echo "> $f has x11 access!"
+                echo "> $f has x11 access!"
-        fi
+            fi
-    
+        done
-    done
+    fi
 

recipes/securecore/recipe-securecore-main-userns.yml

@@ -15,3 +15,4 @@ modules:
   - from-file: common/server-files.yml
   - from-file: common/common-scripts.yml
   - type: secureblue-signing
+  - from-file: common/common-brew.yml

recipes/securecore/recipe-securecore-main.yml

@@ -16,3 +16,4 @@ modules:
   - from-file: common/common-scripts.yml
   - from-file: common/disableuserns-scripts.yml
   - type: secureblue-signing
+  - from-file: common/common-brew.yml

recipes/securecore/recipe-securecore-nvidia-userns.yml

@@ -15,3 +15,4 @@ modules:
   - from-file: common/server-files.yml
   - from-file: common/common-scripts.yml
   - type: secureblue-signing
+  - from-file: common/common-brew.yml

recipes/securecore/recipe-securecore-nvidia.yml

@@ -16,3 +16,4 @@ modules:
   - from-file: common/common-scripts.yml
   - from-file: common/disableuserns-scripts.yml
   - type: secureblue-signing
+  - from-file: common/common-brew.yml

recipes/securecore/recipe-securecore-zfs-main-userns.yml

@@ -15,3 +15,4 @@ modules:
   - from-file: common/server-files.yml
   - from-file: common/common-scripts.yml
   - type: secureblue-signing
+  - from-file: common/common-brew.yml

recipes/securecore/recipe-securecore-zfs-main.yml

@@ -16,3 +16,4 @@ modules:
   - from-file: common/common-scripts.yml
   - from-file: common/disableuserns-scripts.yml
   - type: secureblue-signing
+  - from-file: common/common-brew.yml

recipes/securecore/recipe-securecore-zfs-nvidia-userns.yml

@@ -15,3 +15,4 @@ modules:
   - from-file: common/server-files.yml
   - from-file: common/common-scripts.yml
   - type: secureblue-signing
+  - from-file: common/common-brew.yml

recipes/securecore/recipe-securecore-zfs-nvidia.yml

@@ -16,3 +16,4 @@ modules:
   - from-file: common/common-scripts.yml
   - from-file: common/disableuserns-scripts.yml
   - type: secureblue-signing
+  - from-file: common/common-brew.yml