hakurei/test/sandbox/case/default.nix, branch masterlow-level userspace tooling for Rosa OShttp://src.rosa.moe/hakurei/atom/test/sandbox/case/default.nix?h=master2025-10-18T19:11:38Zhst/container: optional runtime and tmpdir sharing2025-10-18T19:11:38ZOphestracat@gensokyo.uk2025-10-18T18:53:20Zurn:sha1:699c19e972a3cbcc714403aedffcb5ff74386cfc
Sharing and persisting these directories do not always make sense. Make it optional here.
Closes #16.
Signed-off-by: Ophestra <cat@gensokyo.uk>
test/sandbox: create marker in /var/tmp2025-09-14T07:45:17ZOphestracat@gensokyo.uk2025-09-14T07:45:17Zurn:sha1:1cdc6b4246ac82adb0c9ed7620d3f7225f1a3e7f
This prepares the test suite for private TMPDIR.
Signed-off-by: Ophestra <cat@gensokyo.uk>
test/sandbox: bind /var/tmp writable2025-09-14T05:59:53ZOphestracat@gensokyo.uk2025-09-14T05:59:53Zurn:sha1:d0ddd7193407af4162312469f19bd02af4d4bce1
This makes it possible to place markers with private tmpdir.
Signed-off-by: Ophestra <cat@gensokyo.uk>
app/seal: leave $DISPLAY as is on host abstract2025-08-27T11:42:03ZOphestracat@gensokyo.uk2025-08-27T11:40:30Zurn:sha1:acb6931f3e4af62f92dc2ef85ef7c1ac9f7867e4
This helps work around faulty software that misinterprets unix: DISPLAY string.
Signed-off-by: Ophestra <cat@gensokyo.uk>
app: set up acl on X11 socket2025-08-18T02:30:58ZOphestracat@gensokyo.uk2025-08-17T17:24:56Zurn:sha1:83a1c75f1ac4d2d611b3a96474ed07df3cb557b6
The socket is typically owned by the priv-user, and inaccessible by the target user, so just allowing access to the directory is not enough. This change fixes this oversight and add checks that will also be useful for merging https://git.gensokyo.uk/security/hakurei/pulls/1.
Signed-off-by: Ophestra <cat@gensokyo.uk>
test/sandbox: check pd behaviour2025-07-31T18:27:02ZOphestracat@gensokyo.uk2025-07-31T17:11:19Zurn:sha1:987981df7313d0a121121be36f5c8cf86ffeacd1
Signed-off-by: Ophestra <cat@gensokyo.uk>
test/sandbox: add arm64 constants2025-07-08T20:36:35ZOphestracat@gensokyo.uk2025-07-08T19:45:54Zurn:sha1:749a2779f5ba8b2c575d1459db04c9209d914627
Most of these are differences in qemu.
Signed-off-by: Ophestra <cat@gensokyo.uk>
test/sandbox: verify seccomp on all test cases2025-07-08T19:21:35ZOphestracat@gensokyo.uk2025-07-08T18:47:16Zurn:sha1:e574042d765f135814c5afabaf24cb7109fab175
This change also makes seccomp hashes cross-platform.
Signed-off-by: Ophestra <cat@gensokyo.uk>
treewide: rename to hakurei2025-06-24T19:57:41ZOphestracat@gensokyo.uk2025-06-24T18:59:52Zurn:sha1:87e008d56de974947ebb99c2cc40b25d3c2cf43e
Fortify makes little sense for a container tool.
Signed-off-by: Ophestra <cat@gensokyo.uk>
nix: use reverse-DNS style id as unique identifier2025-05-25T11:12:30ZOphestracat@gensokyo.uk2025-05-25T11:12:30Zurn:sha1:2ffca6984a03b2daa3bb114f70ea84e71439559a
Signed-off-by: Ophestra <cat@gensokyo.uk>