[sec-patch] http-headers-more-filter: success with backport/install for YNH 12 stable

Discuss
,
1

I have searched the forum for similar discussions

on

I understand this category is for discussions, not support requests, and not for app requests.

on

This form is written in English but feel free to write in French if you’re more comfortable!

on

Discuss

I tested building a local backport of the trixie package mentioned for the CSP fixes on Debian/YNH 12, and it seems to have build cleanly:

echo 'deb-src http://deb.debian.org/debian/ trixie main' > /etc/apt/sources.list.d/trixie-main-src.list
apt update
apt install build-essential
apt build-dep libnginx-mod-http-headers-more-filter
cd $(mktemp -d)
apt --build source libnginx-mod-http-headers-more-filter

It gave these packages:

# ls *.deb
libnginx-mod-http-headers-more-filter_0.38-2_amd64.deb	libnginx-mod-http-headers-more-filter-dbgsym_0.38-2_amd64.deb

I wouldn’t know howt to make the ynh 12 core use it, but maybe we can get it working, because most apps don’t seem ready for Trixie just yet.

2

Backporting Content-Security-Policy modularity by tituspijean · Pull Request #2354 · YunoHost/yunohost · GitHub to YNH 12 may avoid having to fix YNH 12 apps manually, just for having to revert all that work for the trixie upgrade again.

3

@tituspijean I can now confirm that a manual header fix does work well also on YNH 12, so your changes could be applied to YNH 12 as well.

Hope it can be be merged into YNH 12, maybe just with a version/capability check for
the -a flags instead of a hard version dependency.

For manual application, one can follow up above package build with:

First, it also makes sense to enable the default content security policy header, because it doesn’t break apps that support CSP themself anymore:

yunohost settings set security.experimental.security_experimental_enabled -v 1
yunohost tools regen-conf nginx --with-diff --force
systemctl restart nginx.service

Then:

dpkg -i libnginx-mod-http-headers-more-filter_0.38-2_amd64.deb
sed -i 's/more_set_headers "Content-Security-Policy/more_set_headers -a "Content-Security-Policy/' /etc/nginx/conf.d/security.conf.inc
sed -i 's/more_set_headers "X-Frame-Options/more_set_headers -a "X-Frame-Options/' /etc/nginx/conf.d/security.conf.inc
systemctl restart nginx.service