Possible suggestions to harden VPNControl

[Staff 10638]

Hello!
@nwlyoc

A few suggestions to improve the software, can you please check them and verify whether the detected problems are real?

1. IMPORTANT. The sudo password is piped through xargs, which turns it into a command-line argument for printf. This can make the password temporarily visible through /proc/<pid>/cmdline or process-monitoring tools. xargs can be removed and the password passed directly to sudo -S via stdin. 

2. The AirVPN API key is stored in plaintext inside vpncontrol.conf, while the installation procedure does not enforce restrictive permissions. On a multi-user system, the file could therefore remain readable by other local users. The configuration directory should be 0700 and the file containing the API key 0600.

3. IMPORTANT. The nftables ruleset adds ip saddr to the whitelist after an allowed DNS query and later accepts packets whose ip saddr matches that set. In the OUTPUT chain, ip saddr can be the host's own local address, so this can unintentionally allow subsequent outbound IPv4 traffic and defeat the Network Lock. The whitelist must operate on destination addresses ip daddr, not source addresses. 

Kind regards