diff options
| author | Ophestra Umiker <cat@ophivana.moe> | 2024-10-10 12:44:08 +0900 |
|---|---|---|
| committer | Ophestra Umiker <cat@ophivana.moe> | 2024-10-10 12:44:08 +0900 |
| commit | 86cb5ac1dbd581078b10f5ec1eb723549c662a1b (patch) | |
| tree | 9198789d0a47ebeda49b4e000013cfbf009b1b45 /internal/app/share.runtime.go | |
| parent | 2220055e26bff8b426ebf086d09ba242e5180e76 (diff) | |
app: hardlink sockets to process-specific share local to XDG_RUNTIME_DIR
This avoids adding ACLs to the PulseAudio directory.
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
Diffstat (limited to 'internal/app/share.runtime.go')
| -rw-r--r-- | internal/app/share.runtime.go | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/internal/app/share.runtime.go b/internal/app/share.runtime.go index e43effe2..444d85a2 100644 --- a/internal/app/share.runtime.go +++ b/internal/app/share.runtime.go @@ -16,6 +16,7 @@ const ( func (seal *appSeal) shareRuntime() { // ensure RunDir (e.g. `/run/user/%d/fortify`) seal.sys.ensure(seal.RunDirPath, 0700) + seal.sys.updatePerm(seal.RunDirPath, acl.Execute) // ensure runtime directory ACL (e.g. `/run/user/%d`) seal.sys.updatePerm(seal.RuntimePath, acl.Execute) @@ -28,6 +29,11 @@ func (seal *appSeal) shareRuntime() { // acl is unnecessary as this directory is world executable seal.share = path.Join(seal.SharePath, seal.id.String()) seal.sys.ensureEphemeral(seal.share, 0701) + + // ensure process-specific share local to XDG_RUNTIME_DIR (e.g. `/run/user/%d/fortify/%s`) + seal.shareLocal = path.Join(seal.RunDirPath, seal.id.String()) + seal.sys.ensureEphemeral(seal.shareLocal, 0700) + seal.sys.updatePerm(seal.shareLocal, acl.Execute) } func (seal *appSeal) shareRuntimeChild() string { |