diff options
| author | Ophestra Umiker <cat@ophivana.moe> | 2024-10-13 02:43:00 +0900 |
|---|---|---|
| committer | Ophestra Umiker <cat@ophivana.moe> | 2024-10-13 02:43:00 +0900 |
| commit | e4536b87ad5bc23096eab00f17ac55b7aad23996 (patch) | |
| tree | 332af06b19f9c8fc6695aa8b5d3d84c0f9d82ccd /internal/app/seal.go | |
| parent | 65a5f8fb08421f8fb031d4e21a2c460d218616c6 (diff) | |
app: generate and replace passwd and group files
This ensures libc functions get correct user information.
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
Diffstat (limited to 'internal/app/seal.go')
| -rw-r--r-- | internal/app/seal.go | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/internal/app/seal.go b/internal/app/seal.go index fd42af6d..9199f5b0 100644 --- a/internal/app/seal.go +++ b/internal/app/seal.go @@ -9,6 +9,7 @@ import ( "strconv" "git.ophivana.moe/cat/fortify/dbus" + "git.ophivana.moe/cat/fortify/helper/bwrap" "git.ophivana.moe/cat/fortify/internal" "git.ophivana.moe/cat/fortify/internal/state" "git.ophivana.moe/cat/fortify/internal/verbose" @@ -159,6 +160,11 @@ func (a *app) Seal(config *Config) error { } conf.Filesystem = append(conf.Filesystem, b...) } + // hide nscd from sandbox if present + nscd := "/var/run/nscd" + if _, err := os.Stat(nscd); !errors.Is(err, os.ErrNotExist) { + conf.Tmpfs = append(conf.Tmpfs, bwrap.TmpfsConfig{Size: 8 * 1024, Dir: nscd}) + } // bind GPU stuff if config.Confinement.Enablements.Has(state.EnableX) || config.Confinement.Enablements.Has(state.EnableWayland) { conf.Filesystem = append(conf.Filesystem, &FilesystemConfig{Src: "/dev/dri", Device: true}) |