opensnitch: Add at v1.6.8

[uni-dos]

Summary

• adds the package.yml to include opensnitch.

Test Plan

• Once installed, open the gui and see outgoing traffic.
• There is a conflict with wireguard and opensnitch. Need ebf module.

Checklist

• Package was built and tested against unstable
• This change could gainfully be listed in the weekly sync notes once merged

Resolves #289

[uni-dos]

I did a quick ripgrep for /etc/opensnitchd and updated the locations. Hopefully that was all of them.

[EbonJaeger]

Almost there. Just changing the locations isn't enough; we want users to be able to copy the default configs to /etc, modify them, and have them be loaded. So, we need to check if a file exists in the /etc tree, and use that if there is, otherwise use the /usr/share/defaults/etc path. Does that make sense?

[uni-dos]

Ah got it. I am not familiar with go but Ill give it a shot

[uni-dos]

Not my best work but I think it's done. /etc/rules is created when running opensnitch since these are user preferences. Not sure if the directory will be created each time though.

[EbonJaeger]

Hm I should have clicked Comment instead of Request Changes. Oops.

[uni-dos]

About the /etc/rules. I did not make sense to me that the rules directory should be in /usr/ because these will be created by the user and not Solus itself.

[uni-dos]

An issue I just experienced is that the /etc/opensnitchd/rules is not being created

[EbonJaeger]

I think I might see why.

[silkeh]

Great work! I had a few (admittedly minor) comments on the systemd and Go patches.

[uni-dos]

Hm, opensnitch isn' giving me a pop up to allow ssh. Let me test a bit further.

[silkeh]

Hm, opensnitch isn' giving me a pop up to allow ssh. Let me test a bit further.

Yeah, I think my XDG_RUNTIME_DIR suggestion wasn't correct. See the other thread for a suggestion on how to improve this.

[uni-dos]

So I added the changes and now the socket is not being created. I also am getting a weird issue where the ui is parsing the config file incorrectly. It is interpreting the quotes from default-config.json

[uni-dos]

I also am getting a weird issue where the ui is parsing the config file incorrectly. It is interpreting the quotes from default-config.json

I see an extra quote but it is not creating the socket.

[uni-dos]

Maybe the issue is create_socket_dirs?

[uni-dos]

I was able to get opensnitch to connect to the /run/opensnitch socket but I was not able to get a prompt for eopkg and ssh. I was able to get these without changing the socket

[uni-dos]

I believe the client is the one who creates the socket, but it cannot due to permission. E0208 10:58:04.002137395 5400 chttp2_server.cc:1059] UNKNOWN:No address added out of total 1 resolved for 'unix:///run/opensnitch/osui.sock' {created_time:"2025-02-08T10:58:04.001962687-08:00", children:[UNKNOWN:Unable to configure socket {created_time:"2025-02-08T10:58:04.001941217-08:00", fd:41, children:[UNKNOWN:Permission denied {created_time:"2025-02-08T10:58:04.001937037-08:00", errno:13, os_error:"Permission denied", syscall:"bind"}]}]} Failed to bind to address unix:///run/opensnitch/osui.sock; set GRPC_VERBOSITY=debug environment variable to see detailed error message.

[uni-dos]

I think the default socket in tmp should remain unchanged. If a user changes it to a run/usr dir in their configuration, the socket is created there. Even though having the socket in /run/ is preferred, the gui is the one actually creating the socket limiting the location to a directory the user has permission to write.