diff options
| author | Ophestra <cat@gensokyo.uk> | 2025-03-25 20:00:34 +0900 |
|---|---|---|
| committer | Ophestra <cat@gensokyo.uk> | 2025-03-25 20:00:34 +0900 |
| commit | c326c3f97d6ab04be6b8052200e4dfa6b2f58550 (patch) | |
| tree | 7ed37b1541bb12529c54c82ae80c35ec6e758eff | |
| parent | 971c79bb80e2dc88421f047e82556a39ef063fbf (diff) | |
fst/sandbox: do not create /etc in advance
This is now handled by the setup op. This also gets rid of the hardcoded /etc path.
Signed-off-by: Ophestra <cat@gensokyo.uk>
| -rw-r--r-- | fst/sandbox.go | 4 | ||||
| -rw-r--r-- | internal/app/app_nixos_test.go | 1 | ||||
| -rw-r--r-- | internal/app/app_pd_test.go | 2 | ||||
| -rw-r--r-- | test/sandbox/case/mapuid.nix | 2 | ||||
| -rw-r--r-- | test/sandbox/case/preset.nix | 2 | ||||
| -rw-r--r-- | test/sandbox/case/tty.nix | 2 |
6 files changed, 4 insertions, 9 deletions
diff --git a/fst/sandbox.go b/fst/sandbox.go index b1240eca..fadf39e3 100644 --- a/fst/sandbox.go +++ b/fst/sandbox.go @@ -245,9 +245,7 @@ func (s *SandboxConfig) ToContainer(sys SandboxSys, uid, gid *int) (*sandbox.Par if etcPath == "" { etcPath = "/etc" } - container. - Bind(etcPath, Tmp+"/etc", 0). - Mkdir("/etc", 0700) + container.Bind(etcPath, Tmp+"/etc", 0) // link host /etc contents to prevent dropping passwd/group bind mounts if d, err := sys.ReadDir(etcPath); err != nil { diff --git a/internal/app/app_nixos_test.go b/internal/app/app_nixos_test.go index d89d099b..0b5b42c6 100644 --- a/internal/app/app_nixos_test.go +++ b/internal/app/app_nixos_test.go @@ -124,7 +124,6 @@ var testCasesNixos = []sealTestCase{ Bind("/run/opengl-driver", "/run/opengl-driver", 0). Bind("/dev/dri", "/dev/dri", sandbox.BindDevice|sandbox.BindWritable|sandbox.BindOptional). Bind("/etc", fst.Tmp+"/etc", 0). - Mkdir("/etc", 0700). Link(fst.Tmp+"/etc/alsa", "/etc/alsa"). Link(fst.Tmp+"/etc/bashrc", "/etc/bashrc"). Link(fst.Tmp+"/etc/binfmt.d", "/etc/binfmt.d"). diff --git a/internal/app/app_pd_test.go b/internal/app/app_pd_test.go index bde436f2..50e1611b 100644 --- a/internal/app/app_pd_test.go +++ b/internal/app/app_pd_test.go @@ -67,7 +67,6 @@ var testCasesPd = []sealTestCase{ Tmpfs("/run/user/1971", 8192, 0755). Tmpfs("/run/dbus", 8192, 0755). Bind("/etc", fst.Tmp+"/etc", 0). - Mkdir("/etc", 0700). Link(fst.Tmp+"/etc/alsa", "/etc/alsa"). Link(fst.Tmp+"/etc/bashrc", "/etc/bashrc"). Link(fst.Tmp+"/etc/binfmt.d", "/etc/binfmt.d"). @@ -288,7 +287,6 @@ var testCasesPd = []sealTestCase{ Tmpfs("/run/user/1971", 8192, 0755). Tmpfs("/run/dbus", 8192, 0755). Bind("/etc", fst.Tmp+"/etc", 0). - Mkdir("/etc", 0700). Link(fst.Tmp+"/etc/alsa", "/etc/alsa"). Link(fst.Tmp+"/etc/bashrc", "/etc/bashrc"). Link(fst.Tmp+"/etc/binfmt.d", "/etc/binfmt.d"). diff --git a/test/sandbox/case/mapuid.nix b/test/sandbox/case/mapuid.nix index 634824bf..c44a2aec 100644 --- a/test/sandbox/case/mapuid.nix +++ b/test/sandbox/case/mapuid.nix @@ -39,7 +39,7 @@ urandom = fs "42001b6" null null; zero = fs "42001b6" null null; } null; - etc = fs "800001c0" { + etc = fs "800001ed" { ".clean" = fs "80001ff" null null; ".updated" = fs "80001ff" null null; "NIXOS" = fs "80001ff" null null; diff --git a/test/sandbox/case/preset.nix b/test/sandbox/case/preset.nix index c3ea564f..57ac8210 100644 --- a/test/sandbox/case/preset.nix +++ b/test/sandbox/case/preset.nix @@ -39,7 +39,7 @@ urandom = fs "42001b6" null null; zero = fs "42001b6" null null; } null; - etc = fs "800001c0" { + etc = fs "800001ed" { ".clean" = fs "80001ff" null null; ".updated" = fs "80001ff" null null; "NIXOS" = fs "80001ff" null null; diff --git a/test/sandbox/case/tty.nix b/test/sandbox/case/tty.nix index 1f29e1d6..ef7e3e85 100644 --- a/test/sandbox/case/tty.nix +++ b/test/sandbox/case/tty.nix @@ -40,7 +40,7 @@ urandom = fs "42001b6" null null; zero = fs "42001b6" null null; } null; - etc = fs "800001c0" { + etc = fs "800001ed" { ".clean" = fs "80001ff" null null; ".updated" = fs "80001ff" null null; "NIXOS" = fs "80001ff" null null; |