feat(packaging): add opensnitchd daemon

[rapenne-s]

Assisted-by: copilot with mai-code-1.1-flash model

What problem are you solving?

This implements opensnitch daemon to fix #1583

• I am using an agent and I take responsibility for this PR

---

Changes

This adds dependencies for the daemon of opensnitch github.com/evilsocket/opensnitch

The default configuration file is patched as this make it easier to use the flatpak version I made for the GUI in https://git.coopix.eu/public/flatpak-opensnitch-ui , otherwise the default unix socket is created by the GUI in /tmp/ which is forbidden by flatpak sandboxing, so I defaulted to using TCP to make the setup easier.

I am using it on my system, it is working fine, but although the daemon is packaged correctly, the extra flatpak program (that will never make it to flathub because they forbid this kind of GUI that depend on another service to be useful) feels clunky. I tried to package the UI in dakota, but I didn't succeed.

Honestly, I don't even know if there is an interest, in such situation I'd prefer to know it clearly, so I could stop spending hours on this :)

Testing

• just validate passes
• just boot-test passes (automated boot smoke test)
• just lint passes on a built image
• just boot-fast or just boot-vm — desktop comes up, no regressions

Checklist

• New BST elements wired into deps.bst
• Patches in patches/ regenerated if junction refs changed

[github-actions]

Thanks for the PR! A maintainer will review it.

While you wait, make sure these pass locally:

just validate        # element graph check
just build default   # build the image
just boot-test       # confirm the desktop boots (exits 0 = pass)
just lint            # bootc container lint

If this PR fixes a bug, add verify steps to the linked issue so users can confirm the fix on their hardware after the next nightly ships:

```verify
ujust <something>   # what users should run to confirm the fix
```

[ahmedadan]

@rapenne-s I am still thinking about adding this, I'll let you know when I think we can land it.

Also, for future reference, if I attach myself to the issue, it means I'd like to take a closer look because we have other planned pieces in a similar area and I want to make sure we don't have a conflict.

[ahmedadan]

@rapenne-s Looks like we need to add in some eBBF items for this to work properly. I'll have an actual review ready in a little bit here.

[rapenne-s]

@rapenne-s Looks like we need to add in some eBBF items for this to work properly. I'll have an actual review ready in a little bit here.

Indeed, eBPF support would increase opensnitch efficiency (as explained on their wiki). But this requires adding their kernel module https://github.com/evilsocket/opensnitch/tree/master/ebpf_prog

The fallback is using audit mode as I understand.

[ahmedadan]

Thanks @rapenne-s for working through the packaging. I built the unchanged daemon package on x86_64. Please address the inline packaging and integration points and add runtime coverage for the supported architectures.

[ahmedadan]

This builds the daemon but not its eBPF programs. Please also build and install opensnitch.o, opensnitch-procs.o, and opensnitch-dns.o under /usr/lib/opensnitchd/ebpf/, using the same source revision. Dakota’s existing SDK LLVM can supply the build tools; no global toolchain pin is needed.

[ahmedadan]

This configuration selects eBPF, but full process-event monitoring also requires CONFIG_FTRACE_SYSCALLS. It is disabled in both inspected Dakota kernel configurations, so we need a coordinated change in files/linux/dakota-config.sh and runtime verification before treating this mode as supported.

[ahmedadan]

Could we use a private runtime Unix socket instead? The Flatpak manifest already exposes xdg-run/opensnitch, and I verified that this transport works without network sharing. That avoids trusting whichever local process binds this unauthenticated TCP port; the GUI launcher and explicit user setup would need to configure matching endpoints.

[ahmedadan]

This revision identifies as OpenSnitch 1.9.0, while the linked Flatpak manifest pins UI 1.8.0. Please coordinate a matched daemon/UI version and test it together, rather than make cross-version compatibility part of the supported setup.

[ahmedadan]

For Dakota’s proposed session-scoped behavior, this service also needs logout lifecycle integration. Upstream has graceful cleanup, but this unit does not connect shutdown to the controlling desktop session. Please verify that logout removes OpenSnitch’s active rules and probes without touching other firewall rules, and test crash recovery separately.

[Danathar]

Thanks for packaging this, and for the clear write-up of the Flatpak trade-offs.

I went through the element while ahmedadan works through the eBPF and socket questions. Things that look right to me: every source is pinned to a commit, the preset ships disable opensnitchd.service so nothing changes for users who do not opt in, and the two sed edits match the upstream files at commit a1353848 exactly.

One small thing on top of ahmedadan's points: upstream is GPL-3.0, and other elements here (syncthing.bst, umotd.bst) install the LICENSE file under /usr/share/licenses/<name>/. It would be good to do the same for opensnitchd.

Whether this lands is ahmedadan's call given the related work he mentioned; I just wanted you to know it is being looked at.

[rapenne-s]

Thank you both for your reviews, I'll sort this out, it may take me some time.