diff options
| author | Ophestra <cat@gensokyo.uk> | 2025-02-19 13:41:06 +0900 |
|---|---|---|
| committer | Ophestra <cat@gensokyo.uk> | 2025-02-19 16:20:25 +0900 |
| commit | ef81828e0c1ce6277e0b124f6062eab564dfeceb (patch) | |
| tree | 35a127281d3e75d9a71d070133ce3ed26644a40e /internal/app/app_nixos_test.go | |
| parent | 2978a6f046f52861a7ac749d1e414758caab8bd5 (diff) | |
app: remove share method
This is yet another implementation detail from before system.I, getting rid of this vastly cuts down on redundant seal state.
Signed-off-by: Ophestra <cat@gensokyo.uk>
Diffstat (limited to 'internal/app/app_nixos_test.go')
| -rw-r--r-- | internal/app/app_nixos_test.go | 12 |
1 files changed, 6 insertions, 6 deletions
diff --git a/internal/app/app_nixos_test.go b/internal/app/app_nixos_test.go index 02d9aa27..7ebd32e9 100644 --- a/internal/app/app_nixos_test.go +++ b/internal/app/app_nixos_test.go @@ -18,13 +18,13 @@ var testCasesNixos = []sealTestCase{ AppID: 1, Groups: []string{}, Username: "u0_a1", Outer: "/var/lib/persist/module/fortify/0/1", Sandbox: &fst.SandboxConfig{ - UserNS: true, Net: true, MapRealUID: true, DirectWayland: true, Env: nil, + UserNS: true, Net: true, MapRealUID: true, DirectWayland: true, Env: nil, AutoEtc: true, Filesystem: []*fst.FilesystemConfig{ {Src: "/bin", Must: true}, {Src: "/usr/bin", Must: true}, {Src: "/nix/store", Must: true}, {Src: "/run/current-system", Must: true}, {Src: "/sys/block"}, {Src: "/sys/bus"}, {Src: "/sys/class"}, {Src: "/sys/dev"}, {Src: "/sys/devices"}, {Src: "/run/opengl-driver", Must: true}, {Src: "/dev/dri", Device: true}, - }, AutoEtc: true, + }, Override: []string{"/var/run/nscd"}, }, SystemBus: &dbus.Config{ @@ -56,12 +56,12 @@ var testCasesNixos = []sealTestCase{ }, system.New(1000001). Ensure("/tmp/fortify.1971", 0711). - Ephemeral(system.Process, "/tmp/fortify.1971/8e2c76b066dabe574cf073bdb46eb5c1", 0711). - Ensure("/tmp/fortify.1971/tmpdir", 0700).UpdatePermType(system.User, "/tmp/fortify.1971/tmpdir", acl.Execute). - Ensure("/tmp/fortify.1971/tmpdir/1", 01700).UpdatePermType(system.User, "/tmp/fortify.1971/tmpdir/1", acl.Read, acl.Write, acl.Execute). Ensure("/run/user/1971/fortify", 0700).UpdatePermType(system.User, "/run/user/1971/fortify", acl.Execute). Ensure("/run/user/1971", 0700).UpdatePermType(system.User, "/run/user/1971", acl.Execute). // this is ordered as is because the previous Ensure only calls mkdir if XDG_RUNTIME_DIR is unset + Ephemeral(system.Process, "/tmp/fortify.1971/8e2c76b066dabe574cf073bdb46eb5c1", 0711). Ephemeral(system.Process, "/run/user/1971/fortify/8e2c76b066dabe574cf073bdb46eb5c1", 0700).UpdatePermType(system.Process, "/run/user/1971/fortify/8e2c76b066dabe574cf073bdb46eb5c1", acl.Execute). + Ensure("/tmp/fortify.1971/tmpdir", 0700).UpdatePermType(system.User, "/tmp/fortify.1971/tmpdir", acl.Execute). + Ensure("/tmp/fortify.1971/tmpdir/1", 01700).UpdatePermType(system.User, "/tmp/fortify.1971/tmpdir/1", acl.Read, acl.Write, acl.Execute). UpdatePermType(system.EWayland, "/run/user/1971/wayland-0", acl.Read, acl.Write, acl.Execute). Link("/run/user/1971/pulse/native", "/run/user/1971/fortify/8e2c76b066dabe574cf073bdb46eb5c1/pulse"). CopyFile(nil, "/home/ophestra/xdg/config/pulse/cookie", 256, 256). @@ -205,9 +205,9 @@ var testCasesNixos = []sealTestCase{ Symlink(fst.Tmp+"/etc/zprofile", "/etc/zprofile"). Symlink(fst.Tmp+"/etc/zshenv", "/etc/zshenv"). Symlink(fst.Tmp+"/etc/zshrc", "/etc/zshrc"). - Bind("/tmp/fortify.1971/tmpdir/1", "/tmp", false, true). Tmpfs("/run/user", 1048576). Tmpfs("/run/user/1971", 8388608). + Bind("/tmp/fortify.1971/tmpdir/1", "/tmp", false, true). Bind("/var/lib/persist/module/fortify/0/1", "/var/lib/persist/module/fortify/0/1", false, true). CopyBind("/etc/passwd", []byte("u0_a1:x:1971:1971:Fortify:/var/lib/persist/module/fortify/0/1:/run/current-system/sw/bin/zsh\n")). CopyBind("/etc/group", []byte("fortify:x:1971:\n")). |