fix: wipe credentials in the connect path and keep release builds out of dumps and debuggers

- Credential callbacks (SecretFn) now return Zeroizing<String>, as do the
  session-only/pending caches they read and the RDP client's password,
  so Nexus's own copies are wiped; a plain String copy is made only
  where a library API needs one (SSH password auth, IRC, VNC, CredSSP).
- Release builds disable core dumps (RLIMIT_CORE 0) and, on Linux, mark
  the process non-dumpable (PR_SET_DUMPABLE 0), which also blocks ptrace
  attach and /proc/<pid>/mem reads by other processes of the same user.
  Debug builds are unchanged so they stay debuggable. Verified on the
  release binary: core limit 0, /proc/<pid>/{environ,mem} root-owned and
  unreadable, local shells (including cwd capture) still work.

Closes the remaining parts of SEC-20261012-007 that the app controls;
egui's internal text buffers remain outside its reach.

This commit is contained in:

Andy Dixon

2026-10-12 17:19:27 +01:00

parent aacd44a275

commit fda804e3f5

8 changed files with 43 additions and 17 deletions

									
										rust/app/Cargo.toml
									
		+3
		
												View File
												
				@@ -28,3 +28,6 @@ arboard = "3.6.1"

				[build-dependencies]

				winresource = "0.1"

				[target.'cfg(unix)'.dependencies]

				libc = "0.2"