diff options
| author | Ophestra Umiker <cat@ophivana.moe> | 2024-12-06 04:25:33 +0900 |
|---|---|---|
| committer | Ophestra Umiker <cat@ophivana.moe> | 2024-12-06 04:25:33 +0900 |
| commit | b3ef53b193bdf764d8f04e19ea47901b71eec10b (patch) | |
| tree | f842120ed936715340e4fe48a8913766c65d7581 /internal/app/seal.go | |
| parent | 8d0573405a8a58a57c39b008150d75d3be2894c2 (diff) | |
app: integrate security-context-v1
Should be able to get rid of XDG_RUNTIME_DIR share after this.
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
Diffstat (limited to 'internal/app/seal.go')
| -rw-r--r-- | internal/app/seal.go | 12 |
1 files changed, 3 insertions, 9 deletions
diff --git a/internal/app/seal.go b/internal/app/seal.go index d3c7a875..94c9e061 100644 --- a/internal/app/seal.go +++ b/internal/app/seal.go @@ -8,7 +8,6 @@ import ( "regexp" "strconv" - shim "git.ophivana.moe/security/fortify/cmd/fshim/ipc" "git.ophivana.moe/security/fortify/dbus" "git.ophivana.moe/security/fortify/internal/fmsg" "git.ophivana.moe/security/fortify/internal/linux" @@ -29,8 +28,6 @@ var posixUsername = regexp.MustCompilePOSIX("^[a-z_]([A-Za-z0-9_-]{0,31}|[A-Za-z type appSeal struct { // app unique ID string representation id string - // wayland mediation, disabled if nil - wl *shim.Wayland // dbus proxy message buffer retriever dbusMsg func(f func(msgbuf []string)) @@ -48,6 +45,8 @@ type appSeal struct { // pass-through enablement tracking from config et system.Enablements + // wayland socket direct access + directWayland bool // prevents sharing from happening twice shared bool @@ -204,6 +203,7 @@ func (a *app) Seal(config *Config) error { config.Confinement.Sandbox = conf } + seal.directWayland = config.Confinement.Sandbox.DirectWayland if b, err := config.Confinement.Sandbox.Bwrap(a.os); err != nil { return err } else { @@ -214,12 +214,6 @@ func (a *app) Seal(config *Config) error { seal.sys.bwrap.SetEnv = make(map[string]string) } - // create wayland struct and client wait channel if mediated wayland is enabled - // this field being set enables mediated wayland setup later on - if config.Confinement.Sandbox.Wayland { - seal.wl = shim.NewWayland() - } - // open process state store // the simple store only starts holding an open file after first action // store activity begins after Start is called and must end before Wait |