aboutsummaryrefslogtreecommitdiffhomepage
path: root/internal/app/seal.go
diff options
context:
space:
mode:
authorOphestra Umiker <cat@ophivana.moe>2024-12-18 15:50:46 +0900
committerOphestra Umiker <cat@ophivana.moe>2024-12-18 15:50:46 +0900
commit2f676c9d6e7baac289409cbcabde5b6e53b32ec3 (patch)
tree87f1080df09147f25435cbc44be98dba0f85750b /internal/app/seal.go
parentbbace8f84bfcdff7f6b769b129faac33d44bcb52 (diff)
fst: rename from fipc
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
Diffstat (limited to 'internal/app/seal.go')
-rw-r--r--internal/app/seal.go16
1 files changed, 8 insertions, 8 deletions
diff --git a/internal/app/seal.go b/internal/app/seal.go
index b01befc1..d71553a2 100644
--- a/internal/app/seal.go
+++ b/internal/app/seal.go
@@ -9,7 +9,7 @@ import (
"strconv"
"git.ophivana.moe/security/fortify/dbus"
- "git.ophivana.moe/security/fortify/fipc"
+ "git.ophivana.moe/security/fortify/fst"
"git.ophivana.moe/security/fortify/internal/fmsg"
"git.ophivana.moe/security/fortify/internal/linux"
"git.ophivana.moe/security/fortify/internal/state"
@@ -60,7 +60,7 @@ type appSeal struct {
}
// Seal seals the app launch context
-func (a *app) Seal(config *fipc.Config) error {
+func (a *app) Seal(config *fst.Config) error {
a.lock.Lock()
defer a.lock.Unlock()
@@ -148,7 +148,7 @@ func (a *app) Seal(config *fipc.Config) error {
fmsg.VPrintln("sandbox configuration not supplied, PROCEED WITH CAUTION")
// permissive defaults
- conf := &fipc.SandboxConfig{
+ conf := &fst.SandboxConfig{
UserNS: true,
Net: true,
NoNewSession: true,
@@ -158,7 +158,7 @@ func (a *app) Seal(config *fipc.Config) error {
if d, err := a.os.ReadDir("/"); err != nil {
return err
} else {
- b := make([]*fipc.FilesystemConfig, 0, len(d))
+ b := make([]*fst.FilesystemConfig, 0, len(d))
for _, ent := range d {
p := "/" + ent.Name()
switch p {
@@ -170,7 +170,7 @@ func (a *app) Seal(config *fipc.Config) error {
case "/etc":
default:
- b = append(b, &fipc.FilesystemConfig{Src: p, Write: true, Must: true})
+ b = append(b, &fst.FilesystemConfig{Src: p, Write: true, Must: true})
}
}
conf.Filesystem = append(conf.Filesystem, b...)
@@ -179,7 +179,7 @@ func (a *app) Seal(config *fipc.Config) error {
if d, err := a.os.ReadDir("/run"); err != nil {
return err
} else {
- b := make([]*fipc.FilesystemConfig, 0, len(d))
+ b := make([]*fst.FilesystemConfig, 0, len(d))
for _, ent := range d {
name := ent.Name()
switch name {
@@ -187,7 +187,7 @@ func (a *app) Seal(config *fipc.Config) error {
case "dbus":
default:
p := "/run/" + name
- b = append(b, &fipc.FilesystemConfig{Src: p, Write: true, Must: true})
+ b = append(b, &fst.FilesystemConfig{Src: p, Write: true, Must: true})
}
}
conf.Filesystem = append(conf.Filesystem, b...)
@@ -199,7 +199,7 @@ func (a *app) Seal(config *fipc.Config) error {
}
// bind GPU stuff
if config.Confinement.Enablements.Has(system.EX11) || config.Confinement.Enablements.Has(system.EWayland) {
- conf.Filesystem = append(conf.Filesystem, &fipc.FilesystemConfig{Src: "/dev/dri", Device: true})
+ conf.Filesystem = append(conf.Filesystem, &fst.FilesystemConfig{Src: "/dev/dri", Device: true})
}
config.Confinement.Sandbox = conf