Move sudo commands to a new Vertex Kernel

[quentinguidee]

This pull request adds a new Vertex Kernel executable, which improves security. This way, only some sudo commands are handled by Vertex Kernel, and everything else is handled by Vertex.

How it works

Instead of running vertex, we now need to run vertex-kernel as sudo. vertex-kernel will then start vertex by dropping unnecessary privileges and running it as an unprivileged user.

To run the vertex-kernel, we need to pass the username of the user that runs vertex. By default, it will pass "vertex" as username.

sudo vertex-kernel -user my_username

or

sudo vertex-kernel -uid 1000 -gid 1000

Vertex Kernel will now be able to handle SSH or Docker containers safely.

It is still possible to run Vertex as usual without Vertex-Kernel, but all features that need superuser permissions will not be usable.

Todo

• Create a new executable
• Move sudo commands to the kernel
  • Move Docker commands
  • Move SSH commands
• Make the Vertex-Kernel run Vertex with setcap 'cap_net_bind_service=+ep' vertex, as it needs port 80 for the proxy
• Adapt the updates to download Kernel updates
• Adapt the Dockerfile
• Fix Kernel Logs accessing the same log files
• Forward environment variable to the vertex executable

[quentinguidee]

🚀