diff options
| author | Ophestra Umiker <cat@ophivana.moe> | 2024-11-16 21:19:45 +0900 |
|---|---|---|
| committer | Ophestra Umiker <cat@ophivana.moe> | 2024-11-16 21:19:45 +0900 |
| commit | df33123bd7f1e0cb4e98580b7e63818c82aa7206 (patch) | |
| tree | 8b21831634e6169eb875cbfd359fa4006d6c66b3 /internal/app/config.go | |
| parent | 1a09b55bd4753c6d5cbecf96d1b56f23b0e44b95 (diff) | |
app: integrate fsu
This removes the dependency on external user switchers like sudo/machinectl and decouples fortify user ids from the passwd database.
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
Diffstat (limited to 'internal/app/config.go')
| -rw-r--r-- | internal/app/config.go | 20 |
1 files changed, 13 insertions, 7 deletions
diff --git a/internal/app/config.go b/internal/app/config.go index 96c51ce7..dd45b023 100644 --- a/internal/app/config.go +++ b/internal/app/config.go @@ -15,12 +15,8 @@ const fTmp = "/fortify" type Config struct { // D-Bus application ID ID string `json:"id"` - // username of the target user to switch to - User string `json:"user"` // value passed through to the child process as its argv Command []string `json:"command"` - // string representation of the child's launch method - Method string `json:"method"` // child confinement configuration Confinement ConfinementConfig `json:"confinement"` @@ -28,6 +24,14 @@ type Config struct { // ConfinementConfig defines fortified child's confinement type ConfinementConfig struct { + // numerical application id, determines uid in the init namespace + AppID int `json:"app_id"` + // list of supplementary groups to inherit + Groups []string `json:"groups"` + // passwd username in the sandbox, defaults to chronos + Username string `json:"username,omitempty"` + // home directory in sandbox + Home string `json:"home"` // bwrap sandbox confinement configuration Sandbox *SandboxConfig `json:"sandbox"` @@ -169,8 +173,7 @@ func (s *SandboxConfig) Bwrap(os linux.System) (*bwrap.Config, error) { // Template returns a fully populated instance of Config. func Template() *Config { return &Config{ - ID: "org.chromium.Chromium", - User: "chronos", + ID: "org.chromium.Chromium", Command: []string{ "chromium", "--ignore-gpu-blocklist", @@ -178,8 +181,11 @@ func Template() *Config { "--enable-features=UseOzonePlatform", "--ozone-platform=wayland", }, - Method: "sudo", Confinement: ConfinementConfig{ + AppID: 9, + Groups: []string{"video"}, + Username: "chronos", + Home: "/var/lib/persist/home/org.chromium.Chromium", Sandbox: &SandboxConfig{ Hostname: "localhost", UserNS: true, |