By sandboxing the GoToSocial binary it's possible to control which parts of the system GoToSocial can access, and limit which things it can read and write. This can be helpful to ensure that even in the face of a security issue in GoToSocial, an attacker is severely hindered in escalating their privileges and gaining a foothold on your system.
As GoToSocial is still early in its development, the sandboxing policies we ship may get out of date. If you happen to run into this, please raise an issue on the issue tracker or better yet submit a PR to help us fix it.
Different distributions have different sandboxing mechanisms they prefer and support:
- AppArmor for the Debian or Ubuntu family of distributions or OpenSuSE, including when running with Docker
- SELinux for the Red Hat/Fedora/CentOS family of distributions or Gentoo
Containers and sandboxing
Running GoToSocial as a container does not in and of itself provide much additional security. Despite their name, "containers do not contain". Containers are a distribution mechanism, not a security sandbox. To further secure your container you can instruct the container runtime to load the AppArmor profile and look into limiting which syscalls can be used using a seccomp profile.
We ship an example AppArmor policy for GoToSocial, which you can retrieve and install as follows:
If you're using SQLite, the AppArmor profile expects the database in
/gotosocial/db/ so you'll need to adjust your configuration paths or the policy accordingly.
With the policy installed, you'll need to configure your system to use it to constrain the permissions GoToSocial has.
You can disable the policy like this:
Add the following to the systemd service, or create an override:
Reload systemd and restart GoToSocial:
When using our example Compose file, you can tell it to load the AppArmor policy by tweaking it like so:
When launching the container with
docker run or
podman run, you'll need the
--security-opt="apparmor=gotosocial" command line flag.
SELinux can only be used in combination with the binary installation method. SELinux cannot be used to constrain GoToSocial when running in a container.
The SELinux policy is maintained by the community in the
lzap/gotosocial-selinux repository on GitHub. Make sure to read its documentation, review the policy before using it and use their issue tracker for any support requests around the SELinux policy.