diff options
| author | Ophestra <cat@gensokyo.uk> | 2025-02-17 00:07:52 +0900 |
|---|---|---|
| committer | Ophestra <cat@gensokyo.uk> | 2025-02-17 00:07:52 +0900 |
| commit | 82a072f641b2b8eb4f966a01056283f93b57342f (patch) | |
| tree | 0b9c16370ac7ba825fb530c6483ff3e96f8b97d4 /internal/app/share.go | |
| parent | 60c10c3f4ae9b3093e75a22d03d6a1d0862a2f25 (diff) | |
system/tmpfiles: implement private tmpfiles
These are only available within the mount namespace and should significantly reduce attack surface.
Signed-off-by: Ophestra <cat@gensokyo.uk>
Diffstat (limited to 'internal/app/share.go')
| -rw-r--r-- | internal/app/share.go | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/internal/app/share.go b/internal/app/share.go index c7f0c7a3..1862fb2b 100644 --- a/internal/app/share.go +++ b/internal/app/share.go @@ -231,11 +231,11 @@ func (seal *appSeal) setupShares(bus [2]*dbus.Config, os linux.System) error { // not fatal fmsg.Verbose(strings.TrimSpace(err.(*fmsg.BaseError).Message())) } else { - dst := path.Join(seal.share, "pulse-cookie") innerDst := fst.Tmp + "/pulse-cookie" seal.sys.bwrap.SetEnv[pulseCookie] = innerDst - seal.sys.CopyFile(dst, src) - seal.sys.bwrap.Bind(dst, innerDst) + payload := new([]byte) + seal.sys.bwrap.CopyBindRef(innerDst, &payload) + seal.sys.CopyFile(payload, src, 256, 256) } } |