diff options
| author | Ophestra Umiker <cat@ophivana.moe> | 2024-11-04 03:15:39 +0900 |
|---|---|---|
| committer | Ophestra Umiker <cat@ophivana.moe> | 2024-11-04 03:15:39 +0900 |
| commit | af15b1c048e97c092f7a5eeb30f20d13cd972486 (patch) | |
| tree | c2d9e82655844cbf7130651f3a918b8c8a256f13 /internal/app/seal.go | |
| parent | 7962681f4a9ea0614fe788ca2cda2c697cfff162 (diff) | |
app: support mapping target uid as privileged uid in sandbox
Chromium's D-Bus client implementation refuses to work when its getuid call returns a different value than what the D-Bus server is running as. The reason behind this is not fully understood, but this workaround is implemented to support chromium and electron apps. This is not used by default since it has many side effects that break many other programs, like SSH on NixOS.
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
Diffstat (limited to 'internal/app/seal.go')
| -rw-r--r-- | internal/app/seal.go | 12 |
1 files changed, 10 insertions, 2 deletions
diff --git a/internal/app/seal.go b/internal/app/seal.go index 6852ddc6..aaf8a2d6 100644 --- a/internal/app/seal.go +++ b/internal/app/seal.go @@ -129,6 +129,15 @@ func (a *app) Seal(config *Config) error { // create seal system component seal.sys = new(appSealSys) + // mapped uid + if config.Confinement.Sandbox != nil && config.Confinement.Sandbox.UseRealUID { + seal.sys.mappedID = a.os.Geteuid() + } else { + seal.sys.mappedID = 65534 + } + seal.sys.mappedIDString = strconv.Itoa(seal.sys.mappedID) + seal.sys.runtime = path.Join("/run/user", seal.sys.mappedIDString) + // look up user from system if u, err := a.os.Lookup(config.User); err != nil { if errors.As(err, new(user.UnknownUserError)) { @@ -139,7 +148,6 @@ func (a *app) Seal(config *Config) error { } } else { seal.sys.user = u - seal.sys.runtime = path.Join("/run/user", mappedIDString) } // map sandbox config to bwrap @@ -228,7 +236,7 @@ func (a *app) Seal(config *Config) error { config.Confinement.Sandbox = conf } - seal.sys.bwrap = config.Confinement.Sandbox.Bwrap() + seal.sys.bwrap = config.Confinement.Sandbox.Bwrap(a.os.Geteuid()) seal.sys.override = config.Confinement.Sandbox.Override if seal.sys.bwrap.SetEnv == nil { seal.sys.bwrap.SetEnv = make(map[string]string) |