hakurei/internal/shim/payload.go, branch developlow-level userspace tooling for Rosa OShttp://src.rosa.moe/hakurei/atom/internal/shim/payload.go?h=develop2024-11-01T18:13:57Zcmd: shim and init into separate binaries2024-11-01T18:13:57ZOphestra Umikercat@ophivana.moe2024-11-01T18:03:44Zurn:sha1:584732f80ab91afb349720cfb8e9979ed2ba173e
This change also fixes a deadlock when shim fails to connect and complete the setup.
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
shim: user switcher process management struct2024-10-26T15:46:15ZOphestra Umikercat@ophivana.moe2024-10-26T15:46:15Zurn:sha1:1d6ea8120552665072f5044a004128e7dbbf3a64
This change moves all user switcher and shim management to the shim package and withholds output while shim is alive. This also eliminated all exit scenarios where revert is skipped.
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
migrate to git.ophivana.moe/security/fortify2024-10-20T10:50:13ZOphestra Umikercat@ophivana.moe2024-10-20T10:50:13Zurn:sha1:65af1684e3f12c1920f91c96474f19dbd0b147fc
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
init: custom init process inside sandbox2024-10-13T17:27:02ZOphestra Umikercat@ophivana.moe2024-10-13T17:27:02Zurn:sha1:1302bcede057538665a4eb626357409d8cb515e8
Bubblewrap as init is a bit awkward and don't support a few setup actions fortify will need, such as starting/supervising nscd.
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
shim: update payload comment2024-10-13T08:19:50ZOphestra Umikercat@ophivana.moe2024-10-13T08:19:50Zurn:sha1:3739b56504c7a268241c80b50461a19c4abe699c
Generating permissive default no longer happens in shim.
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
app: generate and replace passwd and group files2024-10-12T17:43:00ZOphestra Umikercat@ophivana.moe2024-10-12T17:43:00Zurn:sha1:e4536b87ad5bc23096eab00f17ac55b7aad23996
This ensures libc functions get correct user information.
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
shim: use bwrap config as it is2024-10-10T19:13:56ZOphestra Umikercat@ophivana.moe2024-10-10T19:13:56Zurn:sha1:3ddfd76cdf82475a3600f8e1c835bf3529ea6a31
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
shim: new shim implementation2024-10-10T16:55:33ZOphestra Umikercat@ophivana.moe2024-10-10T16:55:33Zurn:sha1:b86fa6b4c91a2bf331ae4a50a5aa14b668efc4e6
This implementation of shim accepts configuration as a gob stream over a unix socket, with support for mediating access to wayland via WAYLAND_SOCKET fd. All configuration is now included in the payload, and child is started inside bwrap configured with supplied bwrap.Config.
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>