diff options
| author | Ophestra <cat@gensokyo.uk> | 2024-12-27 14:44:57 +0900 |
|---|---|---|
| committer | Ophestra <cat@gensokyo.uk> | 2024-12-27 14:44:57 +0900 |
| commit | 0a2aa5823bb0a9f04bd910d63b6ef934c6d4f533 (patch) | |
| tree | a130b94a8e1e8624e08bd566ca916cb42191df34 /cmd/fshim | |
| parent | b956ce405219993ab4d881cf4a671ecd510f8548 (diff) | |
cmd/fshim: bind finit inside sandbox
The outer finit executable is normally inaccessible inside the sandbox. This was obscured by the current Nix-based setup exposing /nix/store to the sandbox.
Signed-off-by: Ophestra <cat@gensokyo.uk>
Diffstat (limited to 'cmd/fshim')
| -rw-r--r-- | cmd/fshim/main.go | 7 |
1 files changed, 6 insertions, 1 deletions
diff --git a/cmd/fshim/main.go b/cmd/fshim/main.go index 05b7280d..6b271227 100644 --- a/cmd/fshim/main.go +++ b/cmd/fshim/main.go @@ -9,6 +9,7 @@ import ( init0 "git.gensokyo.uk/security/fortify/cmd/finit/ipc" shim "git.gensokyo.uk/security/fortify/cmd/fshim/ipc" + "git.gensokyo.uk/security/fortify/fst" "git.gensokyo.uk/security/fortify/helper" "git.gensokyo.uk/security/fortify/internal" "git.gensokyo.uk/security/fortify/internal/fmsg" @@ -117,8 +118,12 @@ func main() { }() } + // bind finit inside sandbox + finitInnerPath := path.Join(fst.Tmp, "sbin", "init") + conf.Bind(finitPath, finitInnerPath) + helper.BubblewrapName = payload.Exec[0] // resolved bwrap path by parent - if b, err := helper.NewBwrap(conf, nil, finitPath, + if b, err := helper.NewBwrap(conf, nil, finitInnerPath, func(int, int) []string { return make([]string, 0) }); err != nil { fmsg.Fatalf("malformed sandbox config: %v", err) } else { |