hakurei/internal/shim/main.go, branch developlow-level userspace tooling for Rosa OShttp://src.rosa.moe/hakurei/atom/internal/shim/main.go?h=develop2024-11-01T18:13:57Zcmd: shim and init into separate binaries2024-11-01T18:13:57ZOphestra Umikercat@ophivana.moe2024-11-01T18:03:44Zurn:sha1:584732f80ab91afb349720cfb8e9979ed2ba173e
This change also fixes a deadlock when shim fails to connect and complete the setup.
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
fmsg: support temporarily withholding output2024-10-26T14:09:32ZOphestra Umikercat@ophivana.moe2024-10-26T14:09:32Zurn:sha1:ae1a102882103221ef842176dfd8cb1090d5f591
Trying to print to a shared stdout is a terrible idea. This change makes it possible to withhold output for the lifetime of the sandbox.
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
fmsg: produce all output through fmsg2024-10-21T11:47:02ZOphestra Umikercat@ophivana.moe2024-10-21T11:47:02Zurn:sha1:42e0b168e3d75389dfb968aebf9f5629d64782f9
The behaviour of print functions from package fmt is not thread safe. Functions provided by fmsg wrap around Logger methods. This makes prefix much cleaner and makes it easy to deal with future changes to logging.
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
migrate to git.ophivana.moe/security/fortify2024-10-20T10:50:13ZOphestra Umikercat@ophivana.moe2024-10-20T10:50:13Zurn:sha1:65af1684e3f12c1920f91c96474f19dbd0b147fc
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
init: custom init process inside sandbox2024-10-13T17:27:02ZOphestra Umikercat@ophivana.moe2024-10-13T17:27:02Zurn:sha1:1302bcede057538665a4eb626357409d8cb515e8
Bubblewrap as init is a bit awkward and don't support a few setup actions fortify will need, such as starting/supervising nscd.
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
shim: update payload comment2024-10-13T08:19:50ZOphestra Umikercat@ophivana.moe2024-10-13T08:19:50Zurn:sha1:3739b56504c7a268241c80b50461a19c4abe699c
Generating permissive default no longer happens in shim.
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
shim: re-exec self on startup2024-10-13T07:56:10ZOphestra Umikercat@ophivana.moe2024-10-13T07:56:10Zurn:sha1:77f2c320a6b1d5290c7596d2c8f8b6ba358b5de9
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
shim: get rid of insane launch condition2024-10-13T03:09:38ZOphestra Umikercat@ophivana.moe2024-10-13T03:09:38Zurn:sha1:b47094191145277319b81feb6d1a7f0e3e20b906
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
shim: use bwrap config as it is2024-10-10T19:13:56ZOphestra Umikercat@ophivana.moe2024-10-10T19:13:56Zurn:sha1:3ddfd76cdf82475a3600f8e1c835bf3529ea6a31
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
shim: new shim implementation2024-10-10T16:55:33ZOphestra Umikercat@ophivana.moe2024-10-10T16:55:33Zurn:sha1:b86fa6b4c91a2bf331ae4a50a5aa14b668efc4e6
This implementation of shim accepts configuration as a gob stream over a unix socket, with support for mediating access to wayland via WAYLAND_SOCKET fd. All configuration is now included in the payload, and child is started inside bwrap configured with supplied bwrap.Config.
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>