hakurei/internal/app/config.go, branch developlow-level userspace tooling for Rosa OShttp://src.rosa.moe/hakurei/atom/internal/app/config.go?h=develop2024-12-18T04:45:55Zfipc: export config struct2024-12-18T04:45:55ZOphestra Umikercat@ophivana.moe2024-12-18T04:45:55Zurn:sha1:b752ec44689aa5a3a0f3b9672b218691f161c7c1
Also store full config as part of state.
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
app: integrate security-context-v12024-12-05T19:25:33ZOphestra Umikercat@ophivana.moe2024-12-05T19:25:33Zurn:sha1:b3ef53b193bdf764d8f04e19ea47901b71eec10b
Should be able to get rid of XDG_RUNTIME_DIR share after this.
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
app: alternative inner home path2024-11-17T15:18:21ZOphestra Umikercat@ophivana.moe2024-11-17T15:18:21Zurn:sha1:05b7dbf066cb74d2901ff9acb3a42662a2af722e
Support binding home to an alternative path in the mount namespace.
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
app: integrate fsu2024-11-16T12:19:45ZOphestra Umikercat@ophivana.moe2024-11-16T12:19:45Zurn:sha1:df33123bd7f1e0cb4e98580b7e63818c82aa7206
This removes the dependency on external user switchers like sudo/machinectl and decouples fortify user ids from the passwd database.
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
app/config: rename map_real_uid from use_real_uid2024-11-09T03:01:34ZOphestra Umikercat@ophivana.moe2024-11-09T02:57:36Zurn:sha1:9a13b311ac9b180a9a24e0d99a0487fb1997de32
This option only changes mapped uid in the user namespace.
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
app: support full /dev access2024-11-05T18:49:39ZOphestra Umikercat@ophivana.moe2024-11-05T18:49:39Zurn:sha1:3dfc1fcd566302a71b9b0f215367c3027139f0fb
Also moved /dev/fortify to /fortify since it is impossible to create new directories in /dev from the init namespace and bind mounting its contents has undesirable side effects.
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
app: separate auto etc from permissive defaults2024-11-04T13:18:05ZOphestra Umikercat@ophivana.moe2024-11-04T13:18:05Zurn:sha1:fc25ac2523c512c67d73db5bbbd47224dc0b2001
Populating /etc with symlinks is quite useful even outside the permissive defaults usage pattern.
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
app/config: UseRealUID as true in template2024-11-04T10:45:31ZOphestra Umikercat@ophivana.moe2024-11-04T10:45:31Zurn:sha1:d909b1190ac0e9a357998dd800405bc9bc41f49c
The template is based on a Chromium setup, which this workaround was created for.
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
app: support mapping target uid as privileged uid in sandbox2024-11-03T18:15:39ZOphestra Umikercat@ophivana.moe2024-11-03T18:15:39Zurn:sha1:af15b1c048e97c092f7a5eeb30f20d13cd972486
Chromium's D-Bus client implementation refuses to work when its getuid call returns a different value than what the D-Bus server is running as. The reason behind this is not fully understood, but this workaround is implemented to support chromium and electron apps. This is not used by default since it has many side effects that break many other programs, like SSH on NixOS.
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
app: format mapped uid instead of real uid2024-11-03T15:49:32ZOphestra Umikercat@ophivana.moe2024-11-03T15:49:32Zurn:sha1:7962681f4a9ea0614fe788ca2cda2c697cfff162
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>