diff options
| author | Ophestra <cat@gensokyo.uk> | 2025-12-15 12:43:58 +0900 |
|---|---|---|
| committer | Ophestra <cat@gensokyo.uk> | 2025-12-15 12:57:06 +0900 |
| commit | 54610aaddcc01e335c34087bc0c3bc1de6d23cf8 (patch) | |
| tree | 4e8ad54c21e4440ddd54a2be4089d7d4807f97ac /cmd | |
| parent | 2e806601693e0262641386ce5430d7e8d84b2a77 (diff) | |
internal/outcome: expose pipewire via pipewire-pulse
This no longer exposes the pipewire socket to the container, and instead mediates access via pipewire-pulse. This makes insecure parts of the protocol inaccessible as explained in the doc comment in hst.
Closes #29.
Signed-off-by: Ophestra <cat@gensokyo.uk>
Diffstat (limited to 'cmd')
| -rw-r--r-- | cmd/hakurei/command.go | 9 |
1 files changed, 0 insertions, 9 deletions
diff --git a/cmd/hakurei/command.go b/cmd/hakurei/command.go index ca685790..26c48d78 100644 --- a/cmd/hakurei/command.go +++ b/cmd/hakurei/command.go @@ -14,7 +14,6 @@ import ( _ "unsafe" // for go:linkname "hakurei.app/command" - "hakurei.app/container" "hakurei.app/container/check" "hakurei.app/container/fhs" "hakurei.app/hst" @@ -187,14 +186,6 @@ func buildCommand(ctx context.Context, msg message.Msg, early *earlyHardeningErr }}) } - // start pipewire-pulse: this most likely exists on host if PipeWire is available - if flagPulse { - config.Container.Filesystem = append(config.Container.Filesystem, hst.FilesystemConfigJSON{FilesystemConfig: &hst.FSDaemon{ - Target: fhs.AbsRunUser.Append(strconv.Itoa(container.OverflowUid(msg)), "pulse/native"), - Exec: shell, Args: []string{"-lc", "exec pipewire-pulse"}, - }}) - } - config.Container.Filesystem = append(config.Container.Filesystem, // opportunistically bind kvm hst.FilesystemConfigJSON{FilesystemConfig: &hst.FSBind{ |