@chain305/x-security 0.2.6 → 0.3.1

package/LICENSE

@@ -186,7 +186,7 @@
       same "printed page" as the copyright notice for easier
       identification within third-party archives.
 
-   Copyright 2026 Writ contributors
+   Copyright 2026 x-security contributors
 
    Licensed under the Apache License, Version 2.0 (the "License");
    you may not use this file except in compliance with the License.

package/README.md

@@ -126,7 +126,7 @@ How much of each class a target can **enforce natively**. 🟢 full · 🟡 part
 | API9 · Improper Inventory Management | 🔴 | 🔴 | 🟡 |
 | API10 · Unsafe Consumption of APIs | 🟡 | 🟡 | 🟡 |
 
-Only these three targets are independently **measured** today; Kong, Coraza, NGINX, Envoy and OpenAppSec compile the same policy but aren't yet published with a per-class measurement (⚪). Cells like **🔴→🟢** are the same control stateless vs. with a JWT identity wired — ownership checks (BOLA/BFLA) need to know who the caller is, so a stateless WAF can't enforce them. A **🟡** means the target enforces most of the class natively, not all. Full per-field matrix (incl. the Writ-native injection / prompt-injection / audit classes): **[usewaf.com/coverage](https://usewaf.com/coverage)**.
+Only these three targets are independently **measured** today; Kong, Coraza, NGINX, Envoy and OpenAppSec compile the same policy but aren't yet published with a per-class measurement (⚪). Cells like **🔴→🟢** are the same control stateless vs. with a JWT identity wired — ownership checks (BOLA/BFLA) need to know who the caller is, so a stateless WAF can't enforce them. A **🟡** means the target enforces most of the class natively, not all. Full per-field matrix (incl. the x-security-native injection / prompt-injection / audit classes): **[usewaf.com/coverage](https://usewaf.com/coverage)**.
 
 ## License
 

package/bin/scripts/README.md

@@ -1,7 +1,7 @@
-# Writ firewall — deploy-time DNS wrapper
+# XSecurity firewall — deploy-time DNS wrapper
 
 The generator emits `iptables.rules` and `ip6tables.rules` with placeholder
-tokens of the form `@@WRIT_RESOLVE:<fqdn>@@` wherever a
+tokens of the form `@@X_SECURITY_RESOLVE:<fqdn>@@` wherever a
 `request.schema.<field>.domainAllowlist` entry must be turned into a
 concrete `-d <addr>` clause. iptables itself has no DNS; resolution must
 happen on the host at deploy time and be refreshed periodically.
@@ -12,54 +12,54 @@ These scripts complete that flow.
 
 | File | Destination | Purpose |
 |------|-------------|---------|
-| `writ-resolve.sh` | `/usr/local/sbin/writ-resolve.sh` | One-shot resolver. Reads a template, emits a resolved ruleset. |
-| `writ-refresh.sh` | `/usr/local/sbin/writ-refresh.sh` | Periodic re-resolve + `iptables-restore` apply with flap detection. |
-| `writ-refresh.service` | `/etc/systemd/system/writ-refresh.service` | systemd `Type=oneshot` unit. |
-| `writ-refresh.timer` | `/etc/systemd/system/writ-refresh.timer` | systemd timer; runs every 5 minutes. |
-| `writ.logrotate` | `/etc/logrotate.d/writ` | Optional logrotate config for the refresh log. |
+| `x-security-resolve.sh` | `/usr/local/sbin/x-security-resolve.sh` | One-shot resolver. Reads a template, emits a resolved ruleset. |
+| `x-security-refresh.sh` | `/usr/local/sbin/x-security-refresh.sh` | Periodic re-resolve + `iptables-restore` apply with flap detection. |
+| `x-security-refresh.service` | `/etc/systemd/system/x-security-refresh.service` | systemd `Type=oneshot` unit. |
+| `x-security-refresh.timer` | `/etc/systemd/system/x-security-refresh.timer` | systemd timer; runs every 5 minutes. |
+| `x-security.logrotate` | `/etc/logrotate.d/x-security` | Optional logrotate config for the refresh log. |
 
 ## Installation
 
 ```sh
 # 1. Place the scripts.
-install -m 0755 writ-resolve.sh /usr/local/sbin/writ-resolve.sh
-install -m 0755 writ-refresh.sh /usr/local/sbin/writ-refresh.sh
+install -m 0755 x-security-resolve.sh /usr/local/sbin/x-security-resolve.sh
+install -m 0755 x-security-refresh.sh /usr/local/sbin/x-security-refresh.sh
 
 # 2. Place the rule templates emitted by `lazy generate`.
-install -d /etc/writ
-install -m 0644 iptables.rules  /etc/writ/rules.template
-install -m 0644 ip6tables.rules /etc/writ/rules6.template
+install -d /etc/x-security
+install -m 0644 iptables.rules  /etc/x-security/rules.template
+install -m 0644 ip6tables.rules /etc/x-security/rules6.template
 
-# 3. Replace the ${WRIT_APP_UID} placeholder in both templates with
+# 3. Replace the ${X_SECURITY_APP_UID} placeholder in both templates with
 #    the numeric uid of the application user (e.g. `id -u app-user`).
 APP_UID=$(id -u app-user)
-sed -i "s/\${WRIT_APP_UID}/${APP_UID}/g" \
-  /etc/writ/rules.template /etc/writ/rules6.template
+sed -i "s/\${X_SECURITY_APP_UID}/${APP_UID}/g" \
+  /etc/x-security/rules.template /etc/x-security/rules6.template
 
 # 4. Install + enable the systemd unit.
-install -m 0644 writ-refresh.service /etc/systemd/system/
-install -m 0644 writ-refresh.timer   /etc/systemd/system/
+install -m 0644 x-security-refresh.service /etc/systemd/system/
+install -m 0644 x-security-refresh.timer   /etc/systemd/system/
 systemctl daemon-reload
-systemctl enable --now writ-refresh.timer
+systemctl enable --now x-security-refresh.timer
 
 # 5. (Optional) install logrotate snippet.
-install -m 0644 writ.logrotate /etc/logrotate.d/writ
+install -m 0644 x-security.logrotate /etc/logrotate.d/x-security
 ```
 
-The timer runs `writ-refresh.sh` on boot and every 5 minutes
+The timer runs `x-security-refresh.sh` on boot and every 5 minutes
 thereafter. The first run resolves the template, applies via
-`iptables-restore`, and snapshots to `/etc/writ/rules.applied`.
+`iptables-restore`, and snapshots to `/etc/x-security/rules.applied`.
 
 ## Environment variables
 
 | Variable | Default | Effect |
 |----------|---------|--------|
-| `WRIT_APP_UID` | (none — required) | Numeric uid the rules scope to via `-m owner --uid-owner`. Substitute into the template before installing. |
-| `WRIT_LOG` | `/var/log/writ-resolve.log` | Resolver + refresh log path. Append-only. |
-| `WRIT_CONF_DIR` | `/etc/writ` | Where templates/current/applied/flap-history live. |
-| `WRIT_FLAP_MAX` | `5` | Max ruleset changes within the flap window before holding previous rules. |
-| `WRIT_FLAP_WINDOW` | `900` | Flap detection window in seconds (15 min default). |
-| `WRIT_RESOLVER` | `/usr/local/sbin/writ-resolve.sh` | Path to the resolver script (refresh wrapper uses this). |
+| `X_SECURITY_APP_UID` | (none — required) | Numeric uid the rules scope to via `-m owner --uid-owner`. Substitute into the template before installing. |
+| `X_SECURITY_LOG` | `/var/log/x-security-resolve.log` | Resolver + refresh log path. Append-only. |
+| `X_SECURITY_CONF_DIR` | `/etc/x-security` | Where templates/current/applied/flap-history live. |
+| `X_SECURITY_FLAP_MAX` | `5` | Max ruleset changes within the flap window before holding previous rules. |
+| `X_SECURITY_FLAP_WINDOW` | `900` | Flap detection window in seconds (15 min default). |
+| `X_SECURITY_RESOLVER` | `/usr/local/sbin/x-security-resolve.sh` | Path to the resolver script (refresh wrapper uses this). |
 | `IPTABLES_RESTORE` | `/sbin/iptables-restore` | Override path to `iptables-restore`. |
 | `IP6TABLES_RESTORE` | `/sbin/ip6tables-restore` | Override path to `ip6tables-restore`. |
 
@@ -67,17 +67,17 @@ thereafter. The first run resolves the template, applies via
 
 ```sh
 # stdin → stdout
-cat /etc/writ/rules.template | /usr/local/sbin/writ-resolve.sh
+cat /etc/x-security/rules.template | /usr/local/sbin/x-security-resolve.sh
 
 # file → file, strict mode (default — exit 1 on any failed FQDN)
-/usr/local/sbin/writ-resolve.sh \
-  --rules-file /etc/writ/rules.template \
-  --out       /etc/writ/rules.current
+/usr/local/sbin/x-security-resolve.sh \
+  --rules-file /etc/x-security/rules.template \
+  --out       /etc/x-security/rules.current
 
 # Lenient: drop only the unresolved rules, keep the rest.
-/usr/local/sbin/writ-resolve.sh --lenient \
-  --rules-file /etc/writ/rules.template \
-  --out       /etc/writ/rules.current
+/usr/local/sbin/x-security-resolve.sh --lenient \
+  --rules-file /etc/x-security/rules.template \
+  --out       /etc/x-security/rules.current
 ```
 
 ## Security model
@@ -97,14 +97,14 @@ cat /etc/writ/rules.template | /usr/local/sbin/writ-resolve.sh
    script detects rapid change and freezes the previously-applied
    ruleset rather than thrashing iptables. Threshold is tunable.
 5. **Log integrity.** All resolution outcomes are written append-only to
-   `$WRIT_LOG` with ISO-8601 timestamps. Rotation via logrotate
+   `$X_SECURITY_LOG` with ISO-8601 timestamps. Rotation via logrotate
    (NOT `copytruncate`) preserves append-only semantics.
 
 ## Troubleshooting
 
-- `systemctl status writ-refresh.timer` — is the timer scheduled?
-- `journalctl -u writ-refresh.service` — last few run outcomes.
-- `tail -f /var/log/writ-resolve.log` — per-FQDN resolution traces.
-- `iptables-save | grep writ` — what's actually in the kernel.
+- `systemctl status x-security-refresh.timer` — is the timer scheduled?
+- `journalctl -u x-security-refresh.service` — last few run outcomes.
+- `tail -f /var/log/x-security-resolve.log` — per-FQDN resolution traces.
+- `iptables-save | grep x-security` — what's actually in the kernel.
 - If you see the flap-throttle WARN: investigate DNS instability first;
   the wrapper is doing its job by refusing to apply churn.

package/bin/scripts/{writ-refresh.service → x-security-refresh.service}

@@ -1,18 +1,18 @@
 [Unit]
-Description=Writ firewall refresh (DNS-resolved allowlist apply)
-Documentation=https://github.com/writ/writ
+Description=XSecurity firewall refresh (DNS-resolved allowlist apply)
+Documentation=https://github.com/x-security/x-security
 After=network-online.target
 Wants=network-online.target
 
 [Service]
 Type=oneshot
-ExecStart=/usr/local/sbin/writ-refresh.sh
+ExecStart=/usr/local/sbin/x-security-refresh.sh
 # Fail-closed: a failure here MUST NOT clear existing rules. The script
 # itself is responsible for that (it exits 0 on resolver failure to avoid
 # triggering systemd-restart loops that could thrash iptables).
 SuccessExitStatus=0
 # Hardening: the script only needs network + iptables. No private tmp
-# because the resolver writes /etc/writ/rules.current.
+# because the resolver writes /etc/x-security/rules.current.
 ProtectSystem=false
 ProtectHome=true
 PrivateDevices=true

package/bin/scripts/{writ-refresh.sh → x-security-refresh.sh}

@@ -1,15 +1,15 @@
 #!/bin/sh
-# writ-refresh.sh — periodic re-resolution + apply for Writ rules.
+# x-security-refresh.sh — periodic re-resolution + apply for XSecurity rules.
 #
 # Designed to run from a systemd timer (every 5 min by default). On each
 # tick:
-#   1. Resolve /etc/writ/rules.template via writ-resolve.sh
-#      into /etc/writ/rules.current.
-#   2. Diff against /etc/writ/rules.applied — if unchanged, no-op.
+#   1. Resolve /etc/x-security/rules.template via x-security-resolve.sh
+#      into /etc/x-security/rules.current.
+#   2. Diff against /etc/x-security/rules.applied — if unchanged, no-op.
 #   3. If changed, apply via `iptables-restore` and snapshot
-#      /etc/writ/rules.applied.
+#      /etc/x-security/rules.applied.
 #   4. Flap detection: if the resolved output changes more than
-#      $WRIT_FLAP_MAX times within $WRIT_FLAP_WINDOW seconds,
+#      $X_SECURITY_FLAP_MAX times within $X_SECURITY_FLAP_WINDOW seconds,
 #      hold the previous rules (do NOT apply the new ones) and warn.
 #      This protects against DNS instability (round-robin churn,
 #      misconfigured TTLs, or active DNS attacks).
@@ -21,7 +21,7 @@
 
 set -eu
 
-CONF_DIR="${WRIT_CONF_DIR:-/etc/writ}"
+CONF_DIR="${X_SECURITY_CONF_DIR:-/etc/x-security}"
 TEMPLATE="${CONF_DIR}/rules.template"
 TEMPLATE6="${CONF_DIR}/rules6.template"
 CURRENT="${CONF_DIR}/rules.current"
@@ -29,13 +29,13 @@ CURRENT6="${CONF_DIR}/rules6.current"
 APPLIED="${CONF_DIR}/rules.applied"
 APPLIED6="${CONF_DIR}/rules6.applied"
 FLAP_LOG="${CONF_DIR}/.flap-history"
-LOG_FILE="${WRIT_LOG:-/var/log/writ-resolve.log}"
+LOG_FILE="${X_SECURITY_LOG:-/var/log/x-security-resolve.log}"
 
 # Flap thresholds.
-FLAP_MAX="${WRIT_FLAP_MAX:-5}"
-FLAP_WINDOW="${WRIT_FLAP_WINDOW:-900}"  # 15 minutes default
+FLAP_MAX="${X_SECURITY_FLAP_MAX:-5}"
+FLAP_WINDOW="${X_SECURITY_FLAP_WINDOW:-900}"  # 15 minutes default
 
-RESOLVER="${WRIT_RESOLVER:-/usr/local/sbin/writ-resolve.sh}"
+RESOLVER="${X_SECURITY_RESOLVER:-/usr/local/sbin/x-security-resolve.sh}"
 IPTABLES_RESTORE="${IPTABLES_RESTORE:-/sbin/iptables-restore}"
 IP6TABLES_RESTORE="${IP6TABLES_RESTORE:-/sbin/ip6tables-restore}"
 

package/bin/scripts/{writ-refresh.timer → x-security-refresh.timer}

@@ -1,6 +1,6 @@
 [Unit]
-Description=Writ firewall refresh timer (every 5 minutes)
-Documentation=https://github.com/writ/writ
+Description=XSecurity firewall refresh timer (every 5 minutes)
+Documentation=https://github.com/x-security/x-security
 
 [Timer]
 # Run shortly after boot, then every 5 minutes thereafter. AccuracySec
@@ -9,7 +9,7 @@ OnBootSec=30s
 OnUnitActiveSec=5min
 AccuracySec=30s
 Persistent=true
-Unit=writ-refresh.service
+Unit=x-security-refresh.service
 
 [Install]
 WantedBy=timers.target

package/bin/scripts/{writ-resolve.sh → x-security-resolve.sh}

@@ -1,12 +1,12 @@
 #!/bin/sh
-# writ-resolve.sh — deploy-time DNS resolver for Writ firewall rules.
+# x-security-resolve.sh — deploy-time DNS resolver for XSecurity firewall rules.
 #
-# Reads an iptables-save-format ruleset containing @@WRIT_RESOLVE:<fqdn>@@
+# Reads an iptables-save-format ruleset containing @@X_SECURITY_RESOLVE:<fqdn>@@
 # tokens (produced by `lazy generate --target firewall`) and rewrites
 # each token into one or more concrete `-d <addr>` clauses by resolving the
 # FQDN against the host's system resolver.
 #
-# Generated by Writ — DO NOT EDIT in place. If you need to customize
+# Generated by XSecurity — DO NOT EDIT in place. If you need to customize
 # behavior, override via the environment variables documented in the
 # accompanying README.md.
 #
@@ -27,8 +27,8 @@
 #     via the provided logrotate.d snippet.
 #
 # Usage:
-#   writ-resolve.sh [--rules-file PATH] [--out PATH] [--lenient]
-#   ... | writ-resolve.sh > resolved.rules
+#   x-security-resolve.sh [--rules-file PATH] [--out PATH] [--lenient]
+#   ... | x-security-resolve.sh > resolved.rules
 #
 # Exit codes:
 #   0  success — all tokens resolved
@@ -38,7 +38,7 @@
 
 set -eu
 
-LOG_FILE="${WRIT_LOG:-/var/log/writ-resolve.log}"
+LOG_FILE="${X_SECURITY_LOG:-/var/log/x-security-resolve.log}"
 LENIENT=0
 RULES_FILE=""
 OUT_FILE=""
@@ -52,7 +52,7 @@ log() {
 
 usage() {
   cat >&2 <<'EOF'
-writ-resolve.sh [--rules-file PATH] [--out PATH] [--lenient]
+x-security-resolve.sh [--rules-file PATH] [--out PATH] [--lenient]
 
   --rules-file PATH   Read template from PATH instead of stdin.
   --out PATH          Write resolved ruleset to PATH instead of stdout.
@@ -60,7 +60,7 @@ writ-resolve.sh [--rules-file PATH] [--out PATH] [--lenient]
                       Default is strict: any failed resolution => exit 1.
 
 Environment:
-  WRIT_LOG      Override log path (default /var/log/writ-resolve.log)
+  X_SECURITY_LOG      Override log path (default /var/log/x-security-resolve.log)
 EOF
 }
 
@@ -102,14 +102,14 @@ else
   INPUT=$(cat)
 fi
 
-# Pass 1: extract every @@WRIT_RESOLVE:<fqdn>@@ token. Skip comment
+# Pass 1: extract every @@X_SECURITY_RESOLVE:<fqdn>@@ token. Skip comment
 # lines (the generator's header documents the token format with a literal
-# `@@WRIT_RESOLVE:<fqdn>@@` example — we must not try to resolve
+# `@@X_SECURITY_RESOLVE:<fqdn>@@` example — we must not try to resolve
 # `<fqdn>` as a real hostname).
 FQDNS=$(printf '%s\n' "$INPUT" \
   | grep -v '^[[:space:]]*#' \
-  | grep -oE '@@WRIT_RESOLVE:[^@]+@@' \
-  | sed -e 's/^@@WRIT_RESOLVE://' -e 's/@@$//' \
+  | grep -oE '@@X_SECURITY_RESOLVE:[^@]+@@' \
+  | sed -e 's/^@@X_SECURITY_RESOLVE://' -e 's/@@$//' \
   | sort -u)
 
 TOTAL=0
@@ -132,7 +132,7 @@ if [ -n "$FQDNS" ]; then
     addrs=$(resolve_fqdn "$fqdn" || true)
     if [ -z "$addrs" ]; then
       log "WARN: failed to resolve $fqdn"
-      printf '%s\t__WRIT_UNRESOLVED__\n' "$fqdn" >> "$TMP_MAP"
+      printf '%s\t__X_SECURITY_UNRESOLVED__\n' "$fqdn" >> "$TMP_MAP"
     else
       log "INFO: resolved $fqdn -> $(echo "$addrs" | tr '\n' ' ')"
       echo "$addrs" | while IFS= read -r addr; do
@@ -148,7 +148,7 @@ fi
 # it with `|| echo 0` (that would emit two lines). Use a wc-based count and
 # always trim to a single integer.
 TOTAL=$(printf '%s\n' "$FQDNS" | grep -v '^$' | wc -l | tr -d ' \n')
-FAILED=$(grep -c '__WRIT_UNRESOLVED__' "$TMP_MAP" 2>/dev/null | head -n 1 | tr -d ' \n')
+FAILED=$(grep -c '__X_SECURITY_UNRESOLVED__' "$TMP_MAP" 2>/dev/null | head -n 1 | tr -d ' \n')
 [ -z "$FAILED" ] && FAILED=0
 RESOLVED=$((TOTAL - FAILED))
 
@@ -162,7 +162,7 @@ if [ "$FAILED" -gt 0 ] && [ "$LENIENT" -eq 0 ]; then
   exit 1
 fi
 
-# Pass 2: substitute. For every line containing a @@WRIT_RESOLVE:X@@
+# Pass 2: substitute. For every line containing a @@X_SECURITY_RESOLVE:X@@
 # token, emit one copy per resolved address (with `-d <addr>` replacing the
 # token). Lines for unresolved FQDNs are dropped (in lenient mode), which is
 # fail-closed: those destinations remain unreachable.
@@ -171,7 +171,7 @@ OUTPUT=$(printf '%s\n' "$INPUT" | awk -v mapfile="$TMP_MAP" '
     while ((getline line < mapfile) > 0) {
       n = split(line, f, "\t")
       if (n < 2) continue
-      if (f[2] == "__WRIT_UNRESOLVED__") {
+      if (f[2] == "__X_SECURITY_UNRESOLVED__") {
         unresolved[f[1]] = 1
         continue
       }
@@ -190,10 +190,10 @@ OUTPUT=$(printf '%s\n' "$INPUT" | awk -v mapfile="$TMP_MAP" '
     close(mapfile)
   }
   {
-    if (match($0, /@@WRIT_RESOLVE:[^@]+@@/)) {
+    if (match($0, /@@X_SECURITY_RESOLVE:[^@]+@@/)) {
       token = substr($0, RSTART, RLENGTH)
       fqdn = token
-      sub(/^@@WRIT_RESOLVE:/, "", fqdn)
+      sub(/^@@X_SECURITY_RESOLVE:/, "", fqdn)
       sub(/@@$/, "", fqdn)
       if (fqdn in unresolved) {
         # Drop the rule — fail-closed.
@@ -203,7 +203,7 @@ OUTPUT=$(printf '%s\n' "$INPUT" | awk -v mapfile="$TMP_MAP" '
         m = split(addrs[fqdn], a, "\n")
         for (i = 1; i <= m; i++) {
           line = $0
-          sub(/@@WRIT_RESOLVE:[^@]+@@/, "-d " a[i], line)
+          sub(/@@X_SECURITY_RESOLVE:[^@]+@@/, "-d " a[i], line)
           print line
         }
         next

package/bin/scripts/{writ.logrotate → x-security.logrotate}

@@ -1,6 +1,6 @@
-# /etc/logrotate.d/writ — sample logrotate config for Writ refresh log.
-# Copy to /etc/logrotate.d/writ and adjust paths/retention to taste.
-/var/log/writ-resolve.log {
+# /etc/logrotate.d/x-security — sample logrotate config for XSecurity refresh log.
+# Copy to /etc/logrotate.d/x-security and adjust paths/retention to taste.
+/var/log/x-security-resolve.log {
     weekly
     rotate 8
     compress