diff options
| author | Ophestra <cat@gensokyo.uk> | 2025-01-22 01:51:10 +0900 |
|---|---|---|
| committer | Ophestra <cat@gensokyo.uk> | 2025-01-22 01:52:57 +0900 |
| commit | 9a239fa1a5ad2ff248ca7a9d39342f66926c9fef (patch) | |
| tree | 09efadb2ddf4eaeaf153d7e4b7d73e1b20d2fc1a /internal/app/seal.go | |
| parent | 82029948e6d8d047edc02ccff354e16c419e5742 (diff) | |
helper/bwrap: integrate seccomp into helper interface
This makes API usage much cleaner, and encapsulates all bwrap arguments in argsWt.
Signed-off-by: Ophestra <cat@gensokyo.uk>
Diffstat (limited to 'internal/app/seal.go')
| -rw-r--r-- | internal/app/seal.go | 13 |
1 files changed, 3 insertions, 10 deletions
diff --git a/internal/app/seal.go b/internal/app/seal.go index bd0522a6..228be5c9 100644 --- a/internal/app/seal.go +++ b/internal/app/seal.go @@ -14,6 +14,7 @@ import ( "git.gensokyo.uk/security/fortify/acl" "git.gensokyo.uk/security/fortify/dbus" "git.gensokyo.uk/security/fortify/fst" + "git.gensokyo.uk/security/fortify/helper/bwrap" "git.gensokyo.uk/security/fortify/internal/fmsg" "git.gensokyo.uk/security/fortify/internal/linux" "git.gensokyo.uk/security/fortify/internal/state" @@ -52,8 +53,6 @@ type appSeal struct { et system.Enablements // initial config gob encoding buffer ct io.WriterTo - // pass-through seccomp config from config - scmp *fst.SyscallConfig // wayland socket direct access directWayland bool // extra UpdatePerm ops @@ -196,6 +195,7 @@ func (a *app) Seal(config *fst.Config) error { conf := &fst.SandboxConfig{ UserNS: true, Net: true, + Syscall: new(bwrap.SyscallPolicy), NoNewSession: true, AutoEtc: true, } @@ -233,12 +233,6 @@ func (a *app) Seal(config *fst.Config) error { conf.Filesystem = append(conf.Filesystem, &fst.FilesystemConfig{Src: "/dev/kvm", Device: true}) config.Confinement.Sandbox = conf - - // ensure syscall filter - if config.Confinement.Syscall == nil { - config.Confinement.Syscall = new(fst.SyscallConfig) - config.Confinement.Syscall.Multiarch = true - } } seal.directWayland = config.Confinement.Sandbox.DirectWayland if b, err := config.Confinement.Sandbox.Bwrap(a.os); err != nil { @@ -259,9 +253,8 @@ func (a *app) Seal(config *fst.Config) error { // initialise system interface with full uid seal.sys.I = system.New(seal.sys.user.uid) - // pass through enablements and seccomp + // pass through enablements seal.et = config.Confinement.Enablements - seal.scmp = config.Confinement.Syscall // this method calls all share methods in sequence if err := seal.setupShares([2]*dbus.Config{config.Confinement.SessionBus, config.Confinement.SystemBus}, a.os); err != nil { |