this post was submitted on 25 Jun 2026
52 points (98.1% liked)

Linux

14292 readers
239 users here now

A community for everything relating to the GNU/Linux operating system (except the memes!)

Also, check out:

Original icon base courtesy of lewing@isc.tamu.edu and The GIMP

founded 3 years ago
MODERATORS
Ategon@programming.dev
anzo@programming.dev
dwraf_of_ignorance@programming.dev
52
File canary kill switch (gitlab.com)
submitted 2 weeks ago by lemmyuser@programming.dev to c/linux@programming.dev
14 comments fedilink hide all child comments
 

I wrote a dead simple file canary tool that will install an eBPF program that drops all outgoing packets if a canary is touched. I wrote this in response to the current trend of supply chain attacks that try to harvest credentials

you are viewing a single comment's thread
view the rest of the comments
[โ€“] IanTwenty@piefed.social 4 points 2 weeks ago (3 children)

Thanks to these attacks I think creds got to all move to physical security keys so there's nothing to (digitally) steal any more.This tool is a good idea for the short term.

[โ€“] Flyswat@lemmy.dbzer0.com 1 points 2 weeks ago

Yes using TPM protected TSS2 keys would tie them to your actual machine since only that TPM can internally decrypt them and use them without then being accessible outside. The TPM could be a discrete chip or a software/virtual one.

For instance OpenSSL has an engine/provider for tpm2-tss however I think the software using the keys needs to be engine-aware.

load more comments (2 replies)