hakurei/internal/app/share.system.go, branch developlow-level userspace tooling for Rosa OShttp://src.rosa.moe/hakurei/atom/internal/app/share.system.go?h=develop2024-12-28T02:12:35Zapp: merge share methods2024-12-28T02:12:35ZOphestracat@gensokyo.uk2024-12-28T02:12:35Zurn:sha1:0107620d8c174dcf9237c16d4b4b7b2f6955a214
This significantly increases readability and makes order of ops more obvious.
Signed-off-by: Ophestra <cat@gensokyo.uk>
app: rename /fortify to /.fortify2024-12-21T09:11:32ZOphestracat@gensokyo.uk2024-12-21T09:11:32Zurn:sha1:7a8b625a57c496b880d6ea0d497b8fd0bb066bc6
Also removed the inner share tmpfs mount.
Signed-off-by: Ophestra <cat@gensokyo.uk>
migrate to git.gensokyo.uk/security/fortify2024-12-19T15:20:02ZOphestra Umikercat@ophivana.moe2024-12-19T15:20:02Zurn:sha1:df6fc298f608eb106229efc742f0ef8ce9f78e8b
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
app: alternative inner home path2024-11-17T15:18:21ZOphestra Umikercat@ophivana.moe2024-11-17T15:18:21Zurn:sha1:05b7dbf066cb74d2901ff9acb3a42662a2af722e
Support binding home to an alternative path in the mount namespace.
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
app: integrate fsu2024-11-16T12:19:45ZOphestra Umikercat@ophivana.moe2024-11-16T12:19:45Zurn:sha1:df33123bd7f1e0cb4e98580b7e63818c82aa7206
This removes the dependency on external user switchers like sudo/machinectl and decouples fortify user ids from the passwd database.
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
app: support mapping target uid as privileged uid in sandbox2024-11-03T18:15:39ZOphestra Umikercat@ophivana.moe2024-11-03T18:15:39Zurn:sha1:af15b1c048e97c092f7a5eeb30f20d13cd972486
Chromium's D-Bus client implementation refuses to work when its getuid call returns a different value than what the D-Bus server is running as. The reason behind this is not fully understood, but this workaround is implemented to support chromium and electron apps. This is not used by default since it has many side effects that break many other programs, like SSH on NixOS.
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
app: format mapped uid instead of real uid2024-11-03T15:49:32ZOphestra Umikercat@ophivana.moe2024-11-03T15:49:32Zurn:sha1:7962681f4a9ea0614fe788ca2cda2c697cfff162
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
cmd: shim and init into separate binaries2024-11-01T18:13:57ZOphestra Umikercat@ophivana.moe2024-11-01T18:03:44Zurn:sha1:584732f80ab91afb349720cfb8e9979ed2ba173e
This change also fixes a deadlock when shim fails to connect and complete the setup.
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
internal: wrap calls to os standard library functions2024-10-23T12:46:21ZOphestra Umikercat@ophivana.moe2024-10-23T12:46:21Zurn:sha1:6bc5be7e5a2334274adf2945ad6d29d063a7086b
This change helps tests stub out and simulate OS behaviour during the sealing process. This also removes dependency on XDG_RUNTIME_DIR as the internal.System implementation provided to App provides a compat directory inside the tmpdir-based share when XDG_RUNTIME_DIR is unavailable.
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
migrate to git.ophivana.moe/security/fortify2024-10-20T10:50:13ZOphestra Umikercat@ophivana.moe2024-10-20T10:50:13Zurn:sha1:65af1684e3f12c1920f91c96474f19dbd0b147fc
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>