hakurei/cmd/fshim/ipc, branch developlow-level userspace tooling for Rosa OShttp://src.rosa.moe/hakurei/atom/cmd/fshim/ipc?h=develop2025-01-17T14:43:32Zproc/priv/shim: merge shim into main program2025-01-17T14:43:32ZOphestracat@gensokyo.uk2025-01-17T14:43:32Zurn:sha1:ea8f228af36b2c9ae9918f7760c3af4f1e21cfa2
Signed-off-by: Ophestra <cat@gensokyo.uk>
app: expose single run method2025-01-15T14:39:51ZOphestracat@gensokyo.uk2025-01-15T14:39:51Zurn:sha1:124743ffd3da7c31ef9c562593e15d88bb19008e
App is no longer just a simple [exec.Cmd] wrapper, so exposing these steps separately no longer makes sense and actually hinders proper error handling, cleanup and cancellation. This change removes the five-second wait when the shim dies before receiving the payload, and provides caller the ability to gracefully stop execution of the confined process.
Signed-off-by: Ophestra <cat@gensokyo.uk>
cmd/fshim: ensure data directory2024-12-28T05:39:01ZOphestracat@gensokyo.uk2024-12-28T05:39:01Zurn:sha1:9b206072faa0511eea65f243d36226248c0a098f
Ensuring home directory in shim causes the directory to be owned by the target user.
Signed-off-by: Ophestra <cat@gensokyo.uk>
migrate to git.gensokyo.uk/security/fortify2024-12-19T15:20:02ZOphestra Umikercat@ophivana.moe2024-12-19T15:20:02Zurn:sha1:df6fc298f608eb106229efc742f0ef8ce9f78e8b
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
cmd/fshim: switch to setup pipe2024-12-18T10:39:25ZOphestra Umikercat@ophivana.moe2024-12-18T10:39:25Zurn:sha1:52f21a19f3230e62387bebb88d45d51b6375ac8d
The socket-based approach is no longer necessary as fsu allows extra files and sudo compatibility is no longer relevant.
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
proc: cleaner extra files2024-12-06T07:05:04ZOphestra Umikercat@ophivana.moe2024-12-06T07:05:04Zurn:sha1:cc816a1aaa34946456c0a10ec6f001f865bc69f9
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
app: integrate security-context-v12024-12-05T19:25:33ZOphestra Umikercat@ophivana.moe2024-12-05T19:25:33Zurn:sha1:b3ef53b193bdf764d8f04e19ea47901b71eec10b
Should be able to get rid of XDG_RUNTIME_DIR share after this.
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
cmd/fshim/ipc: install signal handler on shim start2024-11-18T04:33:46ZOphestra Umikercat@ophivana.moe2024-11-18T04:33:46Zurn:sha1:ae2628e57a25e86568fe00281f07cecfa103cde4
Getting killed at this point will result in inconsistent state.
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
app: integrate fsu2024-11-16T12:19:45ZOphestra Umikercat@ophivana.moe2024-11-16T12:19:45Zurn:sha1:df33123bd7f1e0cb4e98580b7e63818c82aa7206
This removes the dependency on external user switchers like sudo/machinectl and decouples fortify user ids from the passwd database.
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
cmd/fshim/ipc: friendly setup timeout message2024-11-02T17:03:30ZOphestra Umikercat@ophivana.moe2024-11-02T17:03:30Zurn:sha1:8cd3651bb612200bc1a4c7456e5722fb24bc10b7
This message eventually gets returned by the app's Start method, so they should be wrapped to provide a friendly message.
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>