diff options
| author | Ophestra <cat@gensokyo.uk> | 2024-12-21 18:11:32 +0900 |
|---|---|---|
| committer | Ophestra <cat@gensokyo.uk> | 2024-12-21 18:11:32 +0900 |
| commit | 7a8b625a57c496b880d6ea0d497b8fd0bb066bc6 (patch) | |
| tree | fa7ff710c88240791214fc91077833371fec4411 /fst | |
| parent | 8bf12bbe683c1edc2c0b1091f87a710630f09bdb (diff) | |
app: rename /fortify to /.fortify
Also removed the inner share tmpfs mount.
Signed-off-by: Ophestra <cat@gensokyo.uk>
Diffstat (limited to 'fst')
| -rw-r--r-- | fst/config.go | 8 |
1 files changed, 4 insertions, 4 deletions
diff --git a/fst/config.go b/fst/config.go index 9566b229..b977034b 100644 --- a/fst/config.go +++ b/fst/config.go @@ -9,7 +9,7 @@ import ( "git.gensokyo.uk/security/fortify/internal/system" ) -const fTmp = "/fortify" +const Tmp = "/.fortify" // Config is used to seal an *App type Config struct { @@ -119,7 +119,7 @@ func (s *SandboxConfig) Bwrap(os linux.System) (*bwrap.Config, error) { }). SetUID(uid).SetGID(uid). Procfs("/proc"). - Tmpfs(fTmp, 4*1024) + Tmpfs(Tmp, 4*1024) if !s.Dev { conf.DevTmpfs("/dev").Mqueue("/dev/mqueue") @@ -148,7 +148,7 @@ func (s *SandboxConfig) Bwrap(os linux.System) (*bwrap.Config, error) { } if s.AutoEtc { - conf.Bind("/etc", fTmp+"/etc") + conf.Bind("/etc", Tmp+"/etc") // link host /etc contents to prevent passwd/group from being overwritten if d, err := os.ReadDir("/etc"); err != nil { @@ -163,7 +163,7 @@ func (s *SandboxConfig) Bwrap(os linux.System) (*bwrap.Config, error) { case "mtab": conf.Symlink("/proc/mounts", "/etc/"+name) default: - conf.Symlink(fTmp+"/etc/"+name, "/etc/"+name) + conf.Symlink(Tmp+"/etc/"+name, "/etc/"+name) } } } |