helper/bwrap: separate sequential/static args

Signed-off-by: Ophestra <cat@gensokyo.uk>

1 files changed, 153 insertions, 142 deletions

diff --git a/helper/bwrap/config_test.go b/helper/bwrap/config_test.go
index afbcedea..95749f09 100644
--- a/helper/bwrap/config_test.go
+++ b/helper/bwrap/config_test.go
@@ -1,6 +1,7 @@
 package bwrap_test
 
 import (
+	"os"
 	"slices"
 	"testing"
 
@@ -14,6 +15,83 @@ func TestConfig_Args(t *testing.T) {
 		want []string
 	}{
 		{
+			name: "bind",
+			conf: (new(bwrap.Config)).
+				Bind("/etc", "/.fortify/etc").
+				Bind("/etc", "/.fortify/etc", true).
+				Bind("/run", "/.fortify/run", false, true).
+				Bind("/sys/devices", "/.fortify/sys/devices", true, true).
+				Bind("/dev/dri", "/.fortify/dev/dri", false, true, true).
+				Bind("/dev/dri", "/.fortify/dev/dri", true, true, true),
+			want: []string{
+				"--unshare-all", "--unshare-user",
+				"--disable-userns", "--assert-userns-disabled",
+				// Bind("/etc", "/.fortify/etc")
+				"--ro-bind", "/etc", "/.fortify/etc",
+				// Bind("/etc", "/.fortify/etc", true)
+				"--ro-bind-try", "/etc", "/.fortify/etc",
+				// Bind("/run", "/.fortify/run", false, true)
+				"--bind", "/run", "/.fortify/run",
+				// Bind("/sys/devices", "/.fortify/sys/devices", true, true)
+				"--bind-try", "/sys/devices", "/.fortify/sys/devices",
+				// Bind("/dev/dri", "/.fortify/dev/dri", false, true, true)
+				"--dev-bind", "/dev/dri", "/.fortify/dev/dri",
+				// Bind("/dev/dri", "/.fortify/dev/dri", true, true, true)
+				"--dev-bind-try", "/dev/dri", "/.fortify/dev/dri",
+			},
+		},
+		{
+			name: "dir remount-ro proc dev mqueue",
+			conf: (new(bwrap.Config)).
+				Dir("/.fortify").
+				RemountRO("/home").
+				Procfs("/proc").
+				DevTmpfs("/dev").
+				Mqueue("/dev/mqueue"),
+			want: []string{
+				"--unshare-all", "--unshare-user",
+				"--disable-userns", "--assert-userns-disabled",
+				// Dir("/.fortify")
+				"--dir", "/.fortify",
+				// RemountRO("/home")
+				"--remount-ro", "/home",
+				// Procfs("/proc")
+				"--proc", "/proc",
+				// DevTmpfs("/dev")
+				"--dev", "/dev",
+				// Mqueue("/dev/mqueue")
+				"--mqueue", "/dev/mqueue",
+			},
+		},
+		{
+			name: "tmpfs",
+			conf: (new(bwrap.Config)).
+				Tmpfs("/run/user", 8192).
+				Tmpfs("/run/dbus", 8192, 0755),
+			want: []string{
+				"--unshare-all", "--unshare-user",
+				"--disable-userns", "--assert-userns-disabled",
+				// Tmpfs("/run/user", 8192)
+				"--size", "8192", "--tmpfs", "/run/user",
+				// Tmpfs("/run/dbus", 8192, 0755)
+				"--perms", "755", "--size", "8192", "--tmpfs", "/run/dbus",
+			},
+		},
+		{
+			name: "symlink",
+			conf: (new(bwrap.Config)).
+				Symlink("/.fortify/sbin/init", "/sbin/init").
+				Symlink("/.fortify/sbin/init", "/sbin/init", 0755),
+			want: []string{
+				"--unshare-all", "--unshare-user",
+				"--disable-userns", "--assert-userns-disabled",
+				// Symlink("/.fortify/sbin/init", "/sbin/init")
+				"--symlink", "/.fortify/sbin/init", "/sbin/init",
+				// Symlink("/.fortify/sbin/init", "/sbin/init", 0755)
+				"--perms", "755", "--symlink", "/.fortify/sbin/init", "/sbin/init",
+			},
+		},
+		{
 			name: "overlayfs",
 			conf: (new(bwrap.Config)).
 				Overlay("/etc", "/etc").
@@ -33,6 +111,64 @@ func TestConfig_Args(t *testing.T) {
 			},
 		},
 		{
+			name: "unshare",
+			conf: &bwrap.Config{Unshare: &bwrap.UnshareConfig{
+				User:   false,
+				IPC:    false,
+				PID:    false,
+				Net:    false,
+				UTS:    false,
+				CGroup: false,
+			}},
+			want: []string{"--disable-userns", "--assert-userns-disabled"},
+		},
+		{
+			name: "uid gid sync",
+			conf: (new(bwrap.Config)).
+				SetUID(1971).
+				SetGID(100).
+				SetSync(os.Stdin),
+			want: []string{
+				"--unshare-all", "--unshare-user",
+				"--disable-userns", "--assert-userns-disabled",
+				// SetUID(1971)
+				"--uid", "1971",
+				// SetGID(100)
+				"--gid", "100",
+				// SetSync(os.Stdin)
+				// this is set when the process is created
+			},
+		},
+		{
+			name: "hostname chdir setenv unsetenv lockfile chmod",
+			conf: &bwrap.Config{
+				Hostname: "fortify",
+				Chdir:    "/.fortify",
+				SetEnv:   map[string]string{"FORTIFY_INIT": "/.fortify/sbin/init"},
+				UnsetEnv: []string{"HOME", "HOST"},
+				LockFile: []string{"/.fortify/lock"},
+				Chmod:    map[string]os.FileMode{"/.fortify/sbin/init": 0755},
+			},
+			want: []string{
+				"--unshare-all", "--unshare-user",
+				"--disable-userns", "--assert-userns-disabled",
+				// Hostname: "fortify"
+				"--hostname", "fortify",
+				// Chdir: "/.fortify"
+				"--chdir", "/.fortify",
+				// UnsetEnv: []string{"HOME", "HOST"}
+				"--unsetenv", "HOME",
+				"--unsetenv", "HOST",
+				// LockFile: []string{"/.fortify/lock"},
+				"--lock-file", "/.fortify/lock",
+				// SetEnv: map[string]string{"FORTIFY_INIT": "/.fortify/sbin/init"}
+				"--setenv", "FORTIFY_INIT", "/.fortify/sbin/init",
+				// Chmod: map[string]os.FileMode{"/.fortify/sbin/init": 0755}
+				"--chmod", "755", "/.fortify/sbin/init",
+			},
+		},
+
+		{
 			name: "xdg-dbus-proxy constraint sample",
 			conf: (&bwrap.Config{
 				Unshare:       nil,
@@ -90,148 +226,6 @@ func TestConfig_Args(t *testing.T) {
 				"--ro-bind", "/etc", "/etc",
 			},
 		},
-		{
-			name: "fortify permissive default nixos",
-			conf: (&bwrap.Config{
-				Unshare:  nil,
-				Net:      true,
-				UserNS:   true,
-				Clearenv: true,
-				SetEnv: map[string]string{
-					"HOME":              "/home/chronos",
-					"TERM":              "xterm-256color",
-					"FORTIFY_INIT":      "3",
-					"XDG_RUNTIME_DIR":   "/run/user/150",
-					"XDG_SESSION_CLASS": "user",
-					"XDG_SESSION_TYPE":  "tty",
-					"SHELL":             "/run/current-system/sw/bin/zsh",
-					"USER":              "chronos",
-				},
-				DieWithParent: true,
-				AsInit:        true,
-			}).SetUID(65534).SetGID(65534).
-				Procfs("/proc").DevTmpfs("/dev").Mqueue("/dev/mqueue").
-				Bind("/bin", "/bin", false, true).
-				Bind("/boot", "/boot", false, true).
-				Bind("/etc", "/etc", false, true).
-				Bind("/home", "/home", false, true).
-				Bind("/lib", "/lib", false, true).
-				Bind("/lib64", "/lib64", false, true).
-				Bind("/nix", "/nix", false, true).
-				Bind("/root", "/root", false, true).
-				Bind("/srv", "/srv", false, true).
-				Bind("/sys", "/sys", false, true).
-				Bind("/usr", "/usr", false, true).
-				Bind("/var", "/var", false, true).
-				Bind("/run/NetworkManager", "/run/NetworkManager", false, true).
-				Bind("/run/agetty.reload", "/run/agetty.reload", false, true).
-				Bind("/run/binfmt", "/run/binfmt", false, true).
-				Bind("/run/booted-system", "/run/booted-system", false, true).
-				Bind("/run/credentials", "/run/credentials", false, true).
-				Bind("/run/cryptsetup", "/run/cryptsetup", false, true).
-				Bind("/run/current-system", "/run/current-system", false, true).
-				Bind("/run/host", "/run/host", false, true).
-				Bind("/run/keys", "/run/keys", false, true).
-				Bind("/run/libvirt", "/run/libvirt", false, true).
-				Bind("/run/libvirtd.pid", "/run/libvirtd.pid", false, true).
-				Bind("/run/lock", "/run/lock", false, true).
-				Bind("/run/log", "/run/log", false, true).
-				Bind("/run/lvm", "/run/lvm", false, true).
-				Bind("/run/mount", "/run/mount", false, true).
-				Bind("/run/nginx", "/run/nginx", false, true).
-				Bind("/run/nscd", "/run/nscd", false, true).
-				Bind("/run/opengl-driver", "/run/opengl-driver", false, true).
-				Bind("/run/pppd", "/run/pppd", false, true).
-				Bind("/run/resolvconf", "/run/resolvconf", false, true).
-				Bind("/run/sddm", "/run/sddm", false, true).
-				Bind("/run/syncoid", "/run/syncoid", false, true).
-				Bind("/run/systemd", "/run/systemd", false, true).
-				Bind("/run/tmpfiles.d", "/run/tmpfiles.d", false, true).
-				Bind("/run/udev", "/run/udev", false, true).
-				Bind("/run/udisks2", "/run/udisks2", false, true).
-				Bind("/run/utmp", "/run/utmp", false, true).
-				Bind("/run/virtlogd.pid", "/run/virtlogd.pid", false, true).
-				Bind("/run/wrappers", "/run/wrappers", false, true).
-				Bind("/run/zed.pid", "/run/zed.pid", false, true).
-				Bind("/run/zed.state", "/run/zed.state", false, true).
-				Bind("/tmp/fortify.1971/tmpdir/150", "/tmp", false, true).
-				Tmpfs("/tmp/fortify.1971", 1048576).
-				Tmpfs("/run/user", 1048576).
-				Tmpfs("/run/user/150", 8388608).
-				Bind("/tmp/fortify.1971/67a97cc824a64ef789f16b20ca6ce311/passwd", "/tmp/fortify.1971/67a97cc824a64ef789f16b20ca6ce311/passwd").
-				Bind("/tmp/fortify.1971/67a97cc824a64ef789f16b20ca6ce311/group", "/tmp/fortify.1971/67a97cc824a64ef789f16b20ca6ce311/group").
-				Bind("/tmp/fortify.1971/67a97cc824a64ef789f16b20ca6ce311/passwd", "/etc/passwd").
-				Bind("/tmp/fortify.1971/67a97cc824a64ef789f16b20ca6ce311/group", "/etc/group").
-				Tmpfs("/var/run/nscd", 8192),
-			want: []string{
-				"--unshare-all", "--unshare-user", "--share-net",
-				"--clearenv", "--die-with-parent", "--as-pid-1",
-				"--uid", "65534",
-				"--gid", "65534",
-				"--setenv", "FORTIFY_INIT", "3",
-				"--setenv", "HOME", "/home/chronos",
-				"--setenv", "SHELL", "/run/current-system/sw/bin/zsh",
-				"--setenv", "TERM", "xterm-256color",
-				"--setenv", "USER", "chronos",
-				"--setenv", "XDG_RUNTIME_DIR", "/run/user/150",
-				"--setenv", "XDG_SESSION_CLASS", "user",
-				"--setenv", "XDG_SESSION_TYPE", "tty",
-				"--proc", "/proc", "--dev", "/dev",
-				"--mqueue", "/dev/mqueue",
-				"--bind", "/bin", "/bin",
-				"--bind", "/boot", "/boot",
-				"--bind", "/etc", "/etc",
-				"--bind", "/home", "/home",
-				"--bind", "/lib", "/lib",
-				"--bind", "/lib64", "/lib64",
-				"--bind", "/nix", "/nix",
-				"--bind", "/root", "/root",
-				"--bind", "/srv", "/srv",
-				"--bind", "/sys", "/sys",
-				"--bind", "/usr", "/usr",
-				"--bind", "/var", "/var",
-				"--bind", "/run/NetworkManager", "/run/NetworkManager",
-				"--bind", "/run/agetty.reload", "/run/agetty.reload",
-				"--bind", "/run/binfmt", "/run/binfmt",
-				"--bind", "/run/booted-system", "/run/booted-system",
-				"--bind", "/run/credentials", "/run/credentials",
-				"--bind", "/run/cryptsetup", "/run/cryptsetup",
-				"--bind", "/run/current-system", "/run/current-system",
-				"--bind", "/run/host", "/run/host",
-				"--bind", "/run/keys", "/run/keys",
-				"--bind", "/run/libvirt", "/run/libvirt",
-				"--bind", "/run/libvirtd.pid", "/run/libvirtd.pid",
-				"--bind", "/run/lock", "/run/lock",
-				"--bind", "/run/log", "/run/log",
-				"--bind", "/run/lvm", "/run/lvm",
-				"--bind", "/run/mount", "/run/mount",
-				"--bind", "/run/nginx", "/run/nginx",
-				"--bind", "/run/nscd", "/run/nscd",
-				"--bind", "/run/opengl-driver", "/run/opengl-driver",
-				"--bind", "/run/pppd", "/run/pppd",
-				"--bind", "/run/resolvconf", "/run/resolvconf",
-				"--bind", "/run/sddm", "/run/sddm",
-				"--bind", "/run/syncoid", "/run/syncoid",
-				"--bind", "/run/systemd", "/run/systemd",
-				"--bind", "/run/tmpfiles.d", "/run/tmpfiles.d",
-				"--bind", "/run/udev", "/run/udev",
-				"--bind", "/run/udisks2", "/run/udisks2",
-				"--bind", "/run/utmp", "/run/utmp",
-				"--bind", "/run/virtlogd.pid", "/run/virtlogd.pid",
-				"--bind", "/run/wrappers", "/run/wrappers",
-				"--bind", "/run/zed.pid", "/run/zed.pid",
-				"--bind", "/run/zed.state", "/run/zed.state",
-				"--bind", "/tmp/fortify.1971/tmpdir/150", "/tmp",
-				"--size", "1048576", "--tmpfs", "/tmp/fortify.1971",
-				"--size", "1048576", "--tmpfs", "/run/user",
-				"--size", "8388608", "--tmpfs", "/run/user/150",
-				"--ro-bind", "/tmp/fortify.1971/67a97cc824a64ef789f16b20ca6ce311/passwd", "/tmp/fortify.1971/67a97cc824a64ef789f16b20ca6ce311/passwd",
-				"--ro-bind", "/tmp/fortify.1971/67a97cc824a64ef789f16b20ca6ce311/group", "/tmp/fortify.1971/67a97cc824a64ef789f16b20ca6ce311/group",
-				"--ro-bind", "/tmp/fortify.1971/67a97cc824a64ef789f16b20ca6ce311/passwd", "/etc/passwd",
-				"--ro-bind", "/tmp/fortify.1971/67a97cc824a64ef789f16b20ca6ce311/group", "/etc/group",
-				"--size", "8192", "--tmpfs", "/var/run/nscd",
-			},
-		},
 	}
 
 	for _, tc := range testCases {
@@ -241,4 +235,21 @@ func TestConfig_Args(t *testing.T) {
 			}
 		})
 	}
+
+	// test persist validation
+	t.Run("invalid persist", func(t *testing.T) {
+		defer func() {
+			wantPanic := "persist called without required paths"
+			if r := recover(); r != wantPanic {
+				t.Errorf("Persist() panic = %v; wantPanic %v", r, wantPanic)
+			}
+		}()
+		(new(bwrap.Config)).Persist("/run", "", "")
+	})
+
+	t.Run("sync file", func(t *testing.T) {
+		if s := (new(bwrap.Config)).SetSync(os.Stdout).Sync(); s != os.Stdout {
+			t.Errorf("Sync() = %v", s)
+		}
+	})
 }